Updated WebKit from /home/jturcott/dev/webkit/ to qtwebkit-4.6-snapshot-22102009 ( 0639bb8e812c8923287cd5523248ca64fa5f7a50 )

Changes in WebKit/qt since the last update:
Jocelyn: fatal error from script, sha1 in src/3rdparty/webkit/VERSION is bad

1270 files changed, 33732 insertions, 11675 deletions

diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index e2c1ef5..fb7dddf 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,114 @@
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add --enable-mathml to configure.
+
+        * configure.ac:
+
+2009-10-15  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] marshal stamp files are not cleaned after a distclean
+        https://bugs.webkit.org/show_bug.cgi?id=30156
+
+        Add the stamp files directly to cleanfiles. Also rearrange the
+        variable declarations so we don't miss any files that need to be
+        cleaned up during the clean targets.
+
+        * GNUmakefile.am:
+
+2009-10-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Help text fix - Web Sockets default is no, not yes.
+
+        * configure.ac:
+
+2009-10-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubberstamped by Eric Seidel.
+
+        [Gtk] Fix icu CFLAG for Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=29517
+
+        Don't escape the srcdir variable. Also use $host instead of the
+        os_foo variables.
+
+        * autotools/webkit.m4:
+
+2009-10-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Use the SQLite3 headers from WebKitLibraries if sqlite3 is undetected
+        https://bugs.webkit.org/show_bug.cgi?id=29518
+
+        * configure.ac:
+
+2009-10-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable TCmalloc for Windows port at the present, because MinGW
+        hasn't got built-in pthread library.
+
+        * WebKit.pri:
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable a few more harmless MSVC warnings.
+
+        * WebKit.pri:
+
+2009-10-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Symbian build break after r48976.
+        unix is set for Symbian in the Qt build system.
+
+        * WebKit.pri:
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Enable TCmalloc for the Linux, Mac and Windows Qt-port
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Remove USE_SYSTEM_MALLOC for Linux, Mac and Windows Qt-port from WebKit.pri,
+        so these Qt-ports will use TCmalloc as other ports.
+
+        * WebKit.pri:
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Add new key event test ensuring that IME keypresses are handled.
+
+        * GNUmakefile.am:
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        Check presence of gstreamer-pbutils-0.10.
+
+        * configure.ac:
+
 2009-09-26  David Kilzer  <ddkilzer@apple.com>
 
         GTK BUILD FIX: add ENABLE_ORIENTATION_EVENTS support to configure.ac
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index b6d1532..b9167a8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -27,6 +27,7 @@
 #define APICast_h
 
 #include "JSAPIValueWrapper.h"
+#include "JSGlobalObject.h"
 #include "JSValue.h"
 #include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
@@ -118,6 +119,7 @@ inline JSContextRef toRef(JSC::ExecState* e)
 
 inline JSGlobalContextRef toGlobalRef(JSC::ExecState* e)
 {
+    ASSERT(e == e->lexicalGlobalObject()->globalExec());
     return reinterpret_cast<JSGlobalContextRef>(e);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index 202b119..c4bd7ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,9 +41,12 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
+protected:
+    static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
+
 private:
     virtual ConstructType getConstructData(ConstructData&);
     virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 3a17fa2..0cf25c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index 86f2f32..d19890a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -50,9 +50,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | OverridesHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | Base::StructureFlags;
+
 private:
     virtual UString className() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index c358a84..e6626b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "JSContextRef.h"
+#include "JSContextRefPrivate.h"
 
 #include "APICast.h"
 #include "InitializeThreading.h"
@@ -152,3 +153,12 @@ JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
     ExecState* exec = toJS(ctx);
     return toRef(&exec->globalData());
 }
+
+JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
+{
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRefPrivate.h
index dc5c03b..ff014ec 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRefPrivate.h
@@ -1,8 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved. 
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * All rights reserved.
+ * Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,45 +20,34 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "ImageSource.h"
-#include "ImageDecoderQt.h"
-
-namespace WebCore {
+#ifndef JSContextRefPrivate_h
+#define JSContextRefPrivate_h
 
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    return m_decoder ? m_decoder->imageAtIndex(index) : 0;
-}
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/WebKitAvailability.h>
 
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
 
-    // Many annoying ads specify a 0 duration to make an image flash as quickly
-    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
-    // for any frames that specify a duration of <= 50 ms.  See
-    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
-    // more.
-    const float duration = m_decoder->duration(index) / 1000.0f;
-    return (duration < 0.051f) ? 0.100f : duration;
-}
+#ifdef __cplusplus
+extern "C" {
+#endif
 
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    return frameIsCompleteAtIndex(index) && m_decoder->supportsAlpha() &&
-        m_decoder->imageAtIndex(index)->hasAlphaChannel();
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    return m_decoder && m_decoder->imageAtIndex(index);
-}
+/*!
+@function
+@abstract Gets the global context of a JavaScript execution context.
+@param ctx The JSContext whose global context you want to get.
+@result ctx's global context.
+*/
+JS_EXPORT JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx);
 
+#ifdef __cplusplus
 }
+#endif
 
-// vim: ts=4 sw=4 et
+#endif /* JSContextRefPrivate_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 05f90b9..8d6c2df 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,17 +1,1180 @@
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some put_by_id_transition code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30539
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition): No need to do object type
+        checks or read Structures and prototypes from objects: they're all known
+        constants at compile time.
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a private API for getting a global context from a context, for
+        clients who want to preserve a context for a later callback.
+
+        * API/APICast.h:
+        (toGlobalRef): Added an ASSERT, since this function is used more often
+        than before.
+
+        * API/JSContextRef.cpp:
+        * API/JSContextRefPrivate.h: Added. The new API.
+
+        * API/tests/testapi.c:
+        (print_callAsFunction):
+        (main): Test the new API.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build and export the new API.
+
+2009-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Tightened up some instanceof code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30488
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): No need to do object type checks - 
+        cell type checks and ImplementsDefaultHasIntance checks implicitly
+        supersede object type checks.
+
+2009-10-18  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Use _stricmp and _strnicmp instead of deprecated stricmp and strnicmp.
+        https://bugs.webkit.org/show_bug.cgi?id=30474
+
+        stricmp and strnicmp are deprecated beginning in Visual
+        C++ 2005. Use _stricmp and _strnicmp instead in StringExtras.h.
+
+        * wtf/StringExtras.h:
+        (strncasecmp):
+        (strcasecmp):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: apparently we shouldn't export those symbols?
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export some symbols.
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        structure typeinfo flags should be inherited.
+        https://bugs.webkit.org/show_bug.cgi?id=30468
+
+        Add StructureFlag constant to the various JSC classes and use
+        it for the TypeInfo construction.  This allows us to simply
+        accumulate flags by basing each classes StructureInfo on its parents.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast for-in enumeration: Cache JSPropertyNameIterator; cache JSStrings
+        in JSPropertyNameIterator; inline more code.
+
+        1.024x as fast on SunSpider (fasta: 1.43x as fast).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        * bytecompiler/BytecodeGenerator.h: Added a few extra operands to
+        op_get_pnames and op_next_pname so that we can track iteration state
+        in the register file instead of in the JSPropertyNameIterator. (To be
+        cacheable, the JSPropertyNameIterator must be stateless.)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::Interpreter::privateExecute): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames): Updated for in-RegisterFile
+        iteration state tracking.
+
+        (JSC::JIT::emit_op_next_pname): Inlined code generation for op_next_pname.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Added has_property and to_object stubs. Removed op_next_pname
+        stub, since has_property is all we need anymore.
+
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames): Don't do caching at this layer
+        anymore, since we don't create a JSPropertyNameIterator at this layer.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create): Do do caching at this layer.
+        (JSC::JSPropertyNameIterator::get):  Updated for in-RegisterFile
+        iteration state tracking.
+        (JSC::JSPropertyNameIterator::markChildren): Mark our JSStrings.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::size):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::JSPropertyNameIterator::cachedStructure):
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::cachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::Structure::setEnumerationCache): Don't store iteration state in
+        a JSPropertyNameIterator. Do cache a JSPropertyNameIterator in a
+        Structure.
+
+        * runtime/JSValue.h:
+        (JSC::asCell):
+        * runtime/MarkStack.h: Make those mischievous #include gods happy.
+
+        * runtime/ObjectConstructor.cpp:
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): Renamed countPrototypeChainEntriesAndCheckForProxies
+        to normalizePrototypeChain, since it changes dictionary prototypes to
+        non-dictionary objects.
+
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end): Simplified some code here to help with
+        current and future refactoring.
+
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition): No need to clear
+        the enumeration cache with adding / removing properties without
+        transition. It is an error to add / remove properties without transition
+        once an object has been observed, and we can ASSERT to catch that.
+
+        * runtime/Structure.h:
+        (JSC::Structure::enumerationCache): Changed the enumeration cache to
+        hold a JSPropertyNameIterator.
+
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::head): Removed StructureChain::isCacheable because
+        it was wrong-headed in two ways: (1) It gave up when a prototype was a
+        dictionary, but instead we want un-dictionary heavily accessed
+        prototypes; (2) It folded a test for hasDefaultGetPropertyNames() into
+        a generic test for "cacheable-ness", but hasDefaultGetPropertyNames()
+        is only releavant to for-in caching.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Debug build in makefile should build Debug_All.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_All configuration.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, we can't use the simple hash there because the PlatformModuleVersion 
+        structure differs.
+
+        * wtf/Platform.h:
+
+2009-10-16  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement ExecutableAllocator for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29946
+
+        Tested with YARR JIT enabled for Symbian; 
+        This patch does not (yet) enable YARR JIT by default.
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::MarkStack::markChildren):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesMarkChildren):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+2009-10-14  Darin Adler  <darin@apple.com>
+
+        Additions so fix for https://bugs.webkit.org/show_bug.cgi?id=18994
+        can build on Windows.
+
+        * wtf/MathExtras.h: Added llround and llroundf for Windows.
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Set ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for plugins while we're still building stubs.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        from the make system into common code.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand reinterpret_cast<void*>
+        https://bugs.webkit.org/show_bug.cgi?id=29034
+
+        Change reinterpret_cast<void*> to regular C style (void*) cast 
+        for the ARM RVCT compiler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): 
+        * jit/JITOpcodes.cpp: Cast to FunctionPtr first 
+           instead of directly casting to reinterpret_cast
+        * jit/JITStubCall.h: Ditto + change the type of m_stub
+          from void* to FunctionPtr.
+        (JSC::JITStubCall::JITStubCall): 
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp: Ditto.
+        (JSC::DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)):
+
+2009-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Re-enable the JIT.
+
+        * wtf/Platform.h:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Support for String.trim(), String.trimLeft() and String.trimRight() methods
+        https://bugs.webkit.org/show_bug.cgi?id=26590
+
+        Implement trim, trimLeft, and trimRight
+
+        * runtime/StringPrototype.cpp:
+        (JSC::isTrimWhitespace):
+           Our normal string whitespace function does not include U+200B which
+           is needed for compatibility with mozilla's implementation of trim.
+           U+200B does not appear to be expected according to spec, however I am
+           choosing to be lax, and match mozilla behavior so have added this
+           exception.
+        (JSC::trimString):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Eliminated some legacy bytecode weirdness.
+        
+        Use vPC[x] subscripting instead of ++vPC to access instruction operands.
+        This is simpler, and often more efficient.
+
+        To support this, and to remove use of hard-coded offsets in bytecode and
+        JIT code generation and dumping, calculate jump offsets from the beginning
+        of an instruction, rather than the middle or end.
+        
+        Also, use OPCODE_LENGTH instead of hard-coded constants for the sizes of
+        opcodes.
+        
+        SunSpider reports no change in JIT mode, and a 1.01x speedup in Interpreter
+        mode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printConditionalJump):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/Label.h:
+        (JSC::Label::setLocation):
+        (JSC::Label::bind):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated some code that didn't belong out of Structure.
+        
+        SunSpider says maybe 1.03x faster.
+
+        * runtime/JSCell.h: Nixed Structure::markAggregate, and made marking of
+        a Structure's prototype the direct responsility of the object using it.
+        (Giving Structure a mark function was misleading because it implied that
+        all live structures get marked during GC, when they don't.)
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren): Added code to mark prototypes stored
+        on the global object. Maybe this wasn't necessary, but now we don't have
+        to wonder.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getEnumerableNamesFromClassInfoTable):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/PropertyNameArray.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache): Moved property name gathering code
+        from Structure to JSObject because having a Structure iterate its JSObject
+        was a layering violation. A JSObject is implemented using a Structure; not
+        the other way around.
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the GTK release build.
+
+        * GNUmakefile.am: Include Grammar.cpp in release builds now that
+        AllInOneFile.cpp is gone.
+
+2009-10-09  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Rubber-stamped by Eric Seidel.
+
+        Add ARM JIT support for Gtk port (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=30228
+
+        * GNUmakefile.am:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: added a few more variable initializations.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSearch):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added missing #include.
+
+        * jsc.cpp:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: initialize variable whose initialization the compiler
+        can't otherwise figure out.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: fixed file name case.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        At long last, I pronounce the death of AllInOneFile.cpp.
+        
+        SunSpider reports a 1.01x speedup.
+
+        * AllInOneFile.cpp: Removed.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added missing project files
+        to compilation stages.
+
+        * parser/Grammar.y:
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        (JSC::jscyylex):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/Collector.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::operator new):
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::operator new):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new):
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::executeRegex): Inlined a few things that Shark said
+        were hot, on the presumption that AllInOneFile.cpp used to inline them
+        automatically.
+
+2009-10-08  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for JIT'ed op_call instructions (evals, constructs, etc.)
+        when !ENABLE(JIT_OPTIMIZE_CALL) && USE(JSVALUE32_64)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30201
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed no longer exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+        
+        Removed the optional lock from Heap::protect, Heap::unprotect, and friends,
+        since WebCore no longer uses it.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        * runtime/Collector.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's IdentifierArena
+        https://bugs.webkit.org/show_bug.cgi?id=30158
+
+        Inherits IdentifierArena class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/ParserArena.cpp:36.
+
+        * parser/ParserArena.h:
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Export DateInstance::info in a way that works on Windows
+
+        Fixes <http://webkit.org/b/30171>
+        fast/dom/Window/window-postmessage-clone.html fails on Windows
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed the export of DateInstance::info from here.
+
+        * runtime/DateInstance.h: Use JS_EXPORTDATA to export
+        DateInstance::info, which is the required way of exporting data on
+        Windows.
+
+2009-10-07  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        When enabling or disabling the JIT through .qmake.cache, make sure
+        to also toggle ENABLE_YARR_JIT.
+
+        * JavaScriptCore.pri:
+
+2009-10-06  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Linking fails with "relocation R_X86_64_PC32 against symbol
+        `cti_vm_throw'"
+        https://bugs.webkit.org/show_bug.cgi?id=28422
+
+        * jit/JITStubs.cpp:
+        Mark cti_vm_throw symbol as PLT-indirect symbol, so it doesn't end up
+        in text segment causing relocation errors on amd64 architecture.
+        Introduced new define SYMBOL_STRING_RELOCATION for such symbols.
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows linking fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Windows build fix.
+
+        * runtime/DateInstance.cpp:
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Expose helpers to throw correct exceptions during object graph walk
+        used for cloning and add a helper function to create Date instances
+        without going through the JS Date constructor function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTypeError):
+        * runtime/ExceptionHelpers.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        * wtf/CrossThreadRefCounted.h:
+        Removed an unused function and assert improvement.
+        (WTF::CrossThreadRefCounted::isOwnedByCurrentThread): Moved out common code from asserts.
+        (WTF::CrossThreadRefCounted::ref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::deref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::crossThreadCopy): Since this includes a potentially
+        non-threadsafe operation, add an assert that the class is owned by the current thread.
+
+2009-10-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add Symbian files to the list of excludes.
+
+        * wscript:
+
+2009-10-05  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove precompiled header from JavaScriptCore compilation to
+        prevent qmake warning during autonomous compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=30069
+
+        * JavaScriptCore.pro:
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the concept of a "fast access cutoff" in arrays, because it
+        punished some patterns of array access too much, and made things too
+        complex for inlining in some cases.
+        
+        1.3% speedup on SunSpider.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::): Check m_vectorLength instead of m_fastAccessCutoff when
+        getting / putting from / to an array. Inline putting past the end of
+        the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::canSetIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::markChildrenDirect): Removed m_fastAccessCutoff, and
+        replaced with checks for JSValue() to detect reads and writes from / to
+        uninitialized parts of the array.
+
+2009-10-02  Jonni Rainisto  <jonni.rainisto@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Math.random() gives too low values on Win32 when _CRT_RAND_S is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29956
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Added PLATFORM(WIN_OS) to handle 15bit rand()
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Take one branch instead of two to test for JSValue().
+        
+        1.1% SunSpider speedup.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_create_arguments):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description): Added support for dumping the new empty value,
+        and deleted values, in debug builds.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue()): Construct JSValue() with the empty value tag.
+
+        (JSC::JSValue::JSValue(JSCell*)): Convert null pointer to the empty value
+        tag, to avoid having two different c++ versions of null / empty.
+
+        (JSC::JSValue::operator bool): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Fix the Qt on Mac OS X build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-10-02  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow enabling and disabling of the JIT through a qmake variable.
+
+        Qt's configure may set this variable through .qmake.cache if a
+        commandline option is given and/or the compile test for hwcap.h
+        failed/succeeded.
+
+        * JavaScriptCore.pri:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29187
+
+        Don't inline ~ListRefPtr() to work around winscw compiler forward declaration
+        bug regarding templated classes.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
+
+        The change will be reverted when the above bug is fixed in winscw compiler.
+
+        * wtf/ListRefPtr.h:
+        (WTF::::~ListRefPtr):
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow custom memory allocation control for the whole JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Since in JavaScriptCore almost every class which has been instantiated by operator new is
+        inherited from FastAllocBase (bug #20422), we disable customizing global operator new for the Qt-port
+        when USE_SYSTEM_MALLOC=0.
+
+        Add #include <unistd.h> to FastMalloc.cpp because it's used by TCMalloc_PageHeap::scavengerThread().
+        (It's needed for the functionality of TCmalloc.)
+
+        Add TCSystemAlloc.cpp to JavaScriptCore.pri if USE_SYSTEM_MALLOC is disabled.
+
+        * JavaScriptCore.pri:
+        * wtf/FastMalloc.cpp:
+        (WTF::sleep):
+        * wtf/FastMalloc.h:
+
+2009-09-30  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by George Staikos.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        Modified by George Wright  <gwright@rim.com> to correctly work
+        with the RVCT-defined __TARGET_ARCH_ARM and __TARGET_ARCH_THUMB
+        compiler macros, as well as adding readability changes.
+
+        * wtf/Platform.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Devirtualise array toString conversion
+
+        Tweak the implementation of Array.prototype.toString to have a fast path
+        when acting on a true JSArray.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
 2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Geoffrey Garen.
 
         Buildfix for platforms using JSVALUE32.
         https://bugs.webkit.org/show_bug.cgi?id=29915
 
         After http://trac.webkit.org/changeset/48905 the build broke in JSVALUE32 case.
+        Also removed unreachable code.
 
         * jit/JITArithmetic.cpp:
         (JSC::JIT::emit_op_add):
          - Declaration of "OperandTypes types" moved before first use.
          - Typos fixed: dst modified to result, regT2 added.
-         - Unnecessary code removed.
+         - Unreachable code removed.
         (JSC::JIT::emitSlow_op_add):
          - Missing declaration of "OperandTypes types" added.
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 15a0c0f..4b316c8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -1,7 +1,6 @@
 {
     'variables': {
         'javascriptcore_files': [
-            'AllInOneFile.cpp',
             'API/APICast.h',
             'API/JavaScript.h',
             'API/JavaScriptCore.h',
@@ -19,6 +18,7 @@
             'API/JSClassRef.h',
             'API/JSContextRef.cpp',
             'API/JSContextRef.h',
+            'API/JSContextRefPrivate.h',
             'API/JSObjectRef.cpp',
             'API/JSObjectRef.h',
             'API/JSProfilerPrivate.cpp',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index 2b08980..89c483e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -137,7 +137,8 @@ SOURCES += \
     interpreter/RegisterFile.cpp
 
 symbian {
-    SOURCES += runtime/MarkStackSymbian.cpp
+    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
+              runtime/MarkStackSymbian.cpp
 } else {
     win32-*|wince* {
         SOURCES += jit/ExecutableAllocatorWin.cpp \
@@ -148,6 +149,10 @@ symbian {
     }
 }
 
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
+}
+
 # AllInOneFile.cpp helps gcc analize and optimize code
 # Other compilers may be able to do this at link time
 SOURCES += \
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index 0cd2e1a..a1affd4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -16,7 +16,6 @@ CONFIG(QTDIR_build) {
     include($$QT_SOURCE_TREE/src/qbase.pri)
     INSTALLS =
     DESTDIR = $$OLDDESTDIR
-    PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 568260a..3681af8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -69,7 +69,13 @@ public:
 
     template<typename FunctionType>
     explicit FunctionPtr(FunctionType* value)
+#if COMPILER(RVCT)
+     // RVTC compiler needs C-style cast as it fails with the following error
+     // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
+        : m_value((void*)(value))
+#else
         : m_value(reinterpret_cast<void*>(value))
+#endif
     {
         ASSERT_VALID_CODE_POINTER(m_value);
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index 6bac9b9..18ca2ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -135,11 +135,6 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static int locationForOffset(const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it, int offset)
-{
-    return it - begin + offset;
-}
-
 static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
 {
     int r0 = (++it)->u.operand;
@@ -156,11 +151,11 @@ static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it,
     printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it, int location, const char* op)
+static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, locationForOffset(begin, it, offset));
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
 }
 
 static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
@@ -852,12 +847,12 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_jmp: {
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_loop: {
             int offset = (++it)->u.operand;
-            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_jtrue: {
@@ -884,56 +879,56 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
@@ -1020,16 +1015,18 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_get_pnames: {
-            int r0 = (++it)->u.operand;
-            int r1 = (++it)->u.operand;
+            int r0 = it[0].u.operand;
+            int r1 = it[1].u.operand;
             printf("[%4d] get_pnames\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
         case op_next_pname: {
-            int dest = (++it)->u.operand;
-            int iter = (++it)->u.operand;
-            int offset = (++it)->u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, locationForOffset(begin, it, offset));
+            int dest = it[0].u.operand;
+            int iter = it[4].u.operand;
+            int offset = it[5].u.operand;
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
@@ -1051,7 +1048,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_jmp_scopes: {
             int scopeDelta = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, location + offset);
             break;
         }
         case op_catch: {
@@ -1074,7 +1071,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index c9196ce..8968252 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -152,8 +152,8 @@ namespace JSC {
         macro(op_strcat, 4) \
         macro(op_to_primitive, 3) \
         \
-        macro(op_get_pnames, 3) \
-        macro(op_next_pname, 4) \
+        macro(op_get_pnames, 6) \
+        macro(op_next_pname, 7) \
         \
         macro(op_push_scope, 2) \
         macro(op_pop_scope, 1) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 8951ce3..41b5c39 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -608,8 +608,9 @@ void ALWAYS_INLINE BytecodeGenerator::rewindUnaryOp()
 
 PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 {
+    size_t begin = instructions().size();
     emitOpcode(target->isForward() ? op_jmp : op_loop);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -624,10 +625,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_lesseq && !target->isForward()) {
@@ -639,10 +642,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_loop_if_lesseq);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
@@ -653,9 +658,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jeq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
@@ -666,16 +673,20 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jneq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     }
 
+    size_t begin = instructions().size();
+
     emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
     instructions().append(cond->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -692,10 +703,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jnless);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_lesseq) {
@@ -707,10 +720,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jnlesseq);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_not) {
@@ -721,9 +736,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jtrue);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_eq_null) {
@@ -734,9 +751,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jneq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_neq_null) {
@@ -747,34 +766,41 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jeq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     }
 
+    size_t begin = instructions().size();
     emitOpcode(op_jfalse);
     instructions().append(cond->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
     instructions().append(m_scopeChain->globalObject()->d()->callFunction);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
     instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -1718,6 +1744,8 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
         }
 
         if (nNormalScopes) {
+            size_t begin = instructions().size();
+
             // We need to remove a number of dynamic scopes to get to the next
             // finally block
             emitOpcode(op_jmp_scopes);
@@ -1726,14 +1754,14 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
             // If topScope == bottomScope then there isn't actually a finally block
             // left to emit, so make the jmp_scopes jump directly to the target label
             if (topScope == bottomScope) {
-                instructions().append(target->offsetFrom(instructions().size()));
+                instructions().append(target->bind(begin, instructions().size()));
                 return target;
             }
 
             // Otherwise we just use jmp_scopes to pop a group of scopes and go
             // to the next instruction
             RefPtr<Label> nextInsn = newLabel();
-            instructions().append(nextInsn->offsetFrom(instructions().size()));
+            instructions().append(nextInsn->bind(begin, instructions().size()));
             emitLabel(nextInsn.get());
         }
 
@@ -1758,27 +1786,47 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpScopes(Label* target, int targetSco
     if (m_finallyDepth)
         return emitComplexJumpScopes(target, &m_scopeContextStack.last(), &m_scopeContextStack.last() - scopeDelta);
 
+    size_t begin = instructions().size();
+
     emitOpcode(op_jmp_scopes);
     instructions().append(scopeDelta);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
-RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID* iter, Label* target)
+RegisterID* BytecodeGenerator::emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget)
+{
+    size_t begin = instructions().size();
+
+    emitOpcode(op_get_pnames);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(i->index());
+    instructions().append(size->index());
+    instructions().append(breakTarget->bind(begin, instructions().size()));
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_next_pname);
     instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(i->index());
+    instructions().append(size->index());
     instructions().append(iter->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return dst;
 }
 
 RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* start, Label* end)
 {
 #if ENABLE(JIT)
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
 #else
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
 #endif
 
     m_codeBlock->addExceptionHandler(info);
@@ -1798,9 +1846,11 @@ RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSV
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpSubroutine(RegisterID* retAddrDst, Label* finally)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jsr);
     instructions().append(retAddrDst->index());
-    instructions().append(finally->offsetFrom(instructions().size()));
+    instructions().append(finally->bind(begin, instructions().size()));
     emitLabel(newLabel().get()); // Record the fact that the next instruction is implicitly labeled, because op_sret will return to it.
     return finally;
 }
@@ -1870,7 +1920,7 @@ static void prepareJumpTableForImmediateSwitch(SimpleJumpTable& jumpTable, int32
         // We're emitting this after the clause labels should have been fixed, so 
         // the labels should not be "forward" references
         ASSERT(!labels[i]->isForward());
-        jumpTable.add(keyForImmediateSwitch(nodes[i], min, max), labels[i]->offsetFrom(switchAddress)); 
+        jumpTable.add(keyForImmediateSwitch(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
     }
 }
 
@@ -1896,7 +1946,7 @@ static void prepareJumpTableForCharacterSwitch(SimpleJumpTable& jumpTable, int32
         // We're emitting this after the clause labels should have been fixed, so 
         // the labels should not be "forward" references
         ASSERT(!labels[i]->isForward());
-        jumpTable.add(keyForCharacterSwitch(nodes[i], min, max), labels[i]->offsetFrom(switchAddress)); 
+        jumpTable.add(keyForCharacterSwitch(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
     }
 }
 
@@ -1910,7 +1960,7 @@ static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t
         ASSERT(nodes[i]->isString());
         UString::Rep* clause = static_cast<StringNode*>(nodes[i])->value().ustring().rep();
         OffsetLocation location;
-        location.branchOffset = labels[i]->offsetFrom(switchAddress);
+        location.branchOffset = labels[i]->bind(switchAddress, switchAddress + 3);
         jumpTable.offsetTable.add(clause, location);
     }
 }
@@ -1921,23 +1971,23 @@ void BytecodeGenerator::endSwitch(uint32_t clauseCount, RefPtr<Label>* labels, E
     m_switchContextStack.removeLast();
     if (switchInfo.switchType == SwitchInfo::SwitchImmediate) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfImmediateSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
         SimpleJumpTable& jumpTable = m_codeBlock->addImmediateSwitchJumpTable();
-        prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes, min, max);
+        prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else if (switchInfo.switchType == SwitchInfo::SwitchCharacter) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfCharacterSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
         
         SimpleJumpTable& jumpTable = m_codeBlock->addCharacterSwitchJumpTable();
-        prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes, min, max);
+        prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else {
         ASSERT(switchInfo.switchType == SwitchInfo::SwitchString);
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfStringSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
         StringJumpTable& jumpTable = m_codeBlock->addStringSwitchJumpTable();
-        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes);
+        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes);
     }
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 1a83ce9..61de173 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -312,8 +312,8 @@ namespace JSC {
         PassRefPtr<Label> emitJumpSubroutine(RegisterID* retAddrDst, Label*);
         void emitSubroutineReturn(RegisterID* retAddrSrc);
 
-        RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base) { return emitUnaryOp(op_get_pnames, dst, base); }
-        RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* iter, Label* target);
+        RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget);
+        RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target);
 
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h
index 0b3d038..8cab1db 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/Label.h
@@ -51,19 +51,17 @@ namespace JSC {
             m_location = location;
 
             unsigned size = m_unresolvedJumps.size();
-            for (unsigned i = 0; i < size; ++i) {
-                unsigned j = m_unresolvedJumps[i];
-                m_codeBlock->instructions()[j].u.operand = m_location - j;
-            }
+            for (unsigned i = 0; i < size; ++i)
+                m_codeBlock->instructions()[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
         }
 
-        int offsetFrom(int location) const
+        int bind(int opcode, int offset) const
         {
             if (m_location == invalidLocation) {
-                m_unresolvedJumps.append(location);
+                m_unresolvedJumps.append(std::make_pair(opcode, offset));
                 return 0;
             }
-            return m_location - location;
+            return m_location - opcode;
         }
 
         void ref() { ++m_refCount; }
@@ -77,7 +75,7 @@ namespace JSC {
         bool isForward() const { return m_location == invalidLocation; }
 
     private:
-        typedef Vector<int, 8> JumpVector;
+        typedef Vector<std::pair<int, int>, 8> JumpVector;
 
         static const unsigned invalidLocation = UINT_MAX;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index dd34265..63cf635 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -51,9 +51,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | JSObject::StructureFlags;
+
     private:
         JSActivation* m_activation;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 71451d6..5b1be71 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -236,6 +236,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -257,7 +258,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index f912298..c8ff849 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue stringTableValues[33] = {
+static const struct HashTableValue stringTableValues[36] = {
    { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
@@ -37,9 +37,12 @@ static const struct HashTableValue stringTableValues[33] = {
    { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
    { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
    { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
 extern JSC_CONST_HASHTABLE HashTable stringTable =
-    { 71, 63, stringTableValues, 0 };
+    { 133, 127, stringTableValues, 0 };
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 847b1fa..53964ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -91,8 +91,8 @@ static int depth(CodeBlock* codeBlock, ScopeChain& sc)
 #if USE(INTERPRETER)
 NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -121,9 +121,9 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
 
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
-    int skip = (vPC + 3)->u.operand + codeBlock->needsFullScopeChain();
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
+    int skip = vPC[3].u.operand + codeBlock->needsFullScopeChain();
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -152,12 +152,12 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
 
 NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int dst = (vPC + 1)->u.operand;
-    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>((vPC + 2)->u.jsCell);
+    int dst = vPC[1].u.operand;
+    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
     ASSERT(globalObject->isGlobalObject());
-    int property = (vPC + 3)->u.operand;
-    Structure* structure = (vPC + 4)->u.structure;
-    int offset = (vPC + 5)->u.operand;
+    int property = vPC[3].u.operand;
+    Structure* structure = vPC[4].u.structure;
+    int offset = vPC[5].u.operand;
 
     if (structure == globalObject->structure()) {
         callFrame->r(dst) = JSValue(globalObject->getDirectOffset(offset));
@@ -192,16 +192,16 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
 
 NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vPC)
 {
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
     callFrame->r(dst) = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
 }
 
 NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int baseDst = (vPC + 1)->u.operand;
-    int propDst = (vPC + 2)->u.operand;
-    int property = (vPC + 3)->u.operand;
+    int baseDst = vPC[1].u.operand;
+    int propDst = vPC[2].u.operand;
+    int property = vPC[3].u.operand;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -233,51 +233,6 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int baseDst = (vPC + 1)->u.operand;
-    int funcDst = (vPC + 2)->u.operand;
-    int property = (vPC + 3)->u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& ident = codeBlock->identifier(property);
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-
-            callFrame->r(baseDst) = JSValue(thisObj);
-            callFrame->r(funcDst) = JSValue(result);
-            return true;
-        }
-        ++iter;
-    } while (iter != end);
-
-    exceptionValue = createUndefinedVariableError(callFrame, ident, vPC - codeBlock->instructions().begin(), codeBlock);
-    return false;
-}
-
 #endif // USE(INTERPRETER)
 
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argc)
@@ -928,10 +883,10 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 #if USE(INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
-    int dst = (++vPC)->u.operand;
+    int dst = vPC[1].u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& property = codeBlock->identifier((++vPC)->u.operand);
-    JSValue value = callFrame->r((++vPC)->u.operand).jsValue();
+    Identifier& property = codeBlock->identifier(vPC[2].u.operand);
+    JSValue value = callFrame->r(vPC[3].u.operand).jsValue();
     JSObject* scope = new (callFrame) JSStaticScopeObject(callFrame, property, value, DontDelete);
     callFrame->r(dst) = JSValue(scope);
 
@@ -983,22 +938,20 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    StructureChain* protoChain = structure->prototypeChain(callFrame);
-    if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_put_by_id_generic);
-        return;
-    }
-
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         if (structure->isDictionary()) {
             vPC[0] = getOpcode(op_put_by_id_generic);
             return;
         }
+
+        // put_by_id_transition checks the prototype chain for setters.
+        normalizePrototypeChain(callFrame, baseCell);
+
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        vPC[6] = protoChain;
+        vPC[6] = structure->prototypeChain(callFrame);
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
         return;
@@ -1094,21 +1047,15 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    StructureChain* protoChain = structure->prototypeChain(callFrame);
-    if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_get_by_id_generic);
-        return;
-    }
-
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = protoChain;
+    vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
@@ -1213,10 +1160,10 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Constructs a new empty Object instance using the original
            constructor, and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
         callFrame->r(dst) = JSValue(constructEmptyObject(callFrame));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_object);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_array) {
@@ -1227,13 +1174,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            The array will contain argCount elements with values
            taken from registers starting at register firstArg.
         */
-        int dst = (++vPC)->u.operand;
-        int firstArg = (++vPC)->u.operand;
-        int argCount = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int firstArg = vPC[2].u.operand;
+        int argCount = vPC[3].u.operand;
         ArgList args(callFrame->registers() + firstArg, argCount);
         callFrame->r(dst) = JSValue(constructArray(callFrame, args));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_array);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_regexp) {
@@ -1243,11 +1190,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor from regexp regExp, and puts the result in
            register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int regExp = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int regExp = vPC[2].u.operand;
         callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_regexp);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mov) {
@@ -1255,11 +1202,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            Copies register src to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = callFrame->r(src);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_mov);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_eq) {
@@ -1269,9 +1216,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            as with the ECMAScript '==' operator, and puts the result
            as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsBoolean(src1.asInt32() == src2.asInt32());
         else {
@@ -1280,7 +1227,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_eq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_eq_null) {
@@ -1289,17 +1236,17 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Checks whether register src is null, as with the ECMAScript '!='
            operator, and puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame->r(dst) = jsBoolean(true);
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_eq_null);
             NEXT_INSTRUCTION();
         }
         
         callFrame->r(dst) = jsBoolean(src.isCell() && src.asCell()->structure()->typeInfo().masqueradesAsUndefined());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_eq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_neq) {
@@ -1309,9 +1256,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            equal, as with the ECMAScript '!=' operator, and puts the
            result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsBoolean(src1.asInt32() != src2.asInt32());
         else {
@@ -1320,7 +1267,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_neq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_neq_null) {
@@ -1329,17 +1276,17 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Checks whether register src is not null, as with the ECMAScript '!='
            operator, and puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame->r(dst) = jsBoolean(false);
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_neq_null);
             NEXT_INSTRUCTION();
         }
         
         callFrame->r(dst) = jsBoolean(!src.isCell() || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_neq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_stricteq) {
@@ -1349,12 +1296,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            equal, as with the ECMAScript '===' operator, and puts the
            result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_nstricteq) {
@@ -1364,12 +1311,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            strictly equal, as with the ECMAScript '!==' operator, and
            puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_less) {
@@ -1379,14 +1326,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            with the ECMAScript '<' operator, and puts the result as
            a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         JSValue result = jsBoolean(jsLess(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_less);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_lesseq) {
@@ -1396,14 +1343,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register src2, as with the ECMAScript '<=' operator, and
            puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         JSValue result = jsBoolean(jsLessEq(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_lesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pre_inc) {
@@ -1412,7 +1359,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register srcDst to number, adds one, and puts the result
            back in register srcDst.
         */
-        int srcDst = (++vPC)->u.operand;
+        int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX)
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
@@ -1422,7 +1369,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(srcDst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pre_inc);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pre_dec) {
@@ -1431,7 +1378,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register srcDst to number, subtracts one, and puts the result
            back in register srcDst.
         */
-        int srcDst = (++vPC)->u.operand;
+        int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN)
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
@@ -1441,7 +1388,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(srcDst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pre_dec);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_post_inc) {
@@ -1451,8 +1398,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            written to register dst, and the number plus one is written
            back to register srcDst.
         */
-        int dst = (++vPC)->u.operand;
-        int srcDst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX) {
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
@@ -1464,7 +1411,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = number;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_post_inc);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_post_dec) {
@@ -1474,8 +1421,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            written to register dst, and the number minus one is written
            back to register srcDst.
         */
-        int dst = (++vPC)->u.operand;
-        int srcDst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN) {
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
@@ -1487,7 +1434,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = number;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_post_dec);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_to_jsnumber) {
@@ -1496,8 +1443,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register src to number, and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
 
         JSValue srcVal = callFrame->r(src).jsValue();
 
@@ -1509,7 +1456,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_to_jsnumber);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_negate) {
@@ -1518,8 +1465,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register src to number, negates it, and puts the
            result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32() && src.asInt32())
             callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
@@ -1528,7 +1475,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_negate);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_add) {
@@ -1538,9 +1485,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            in register dst. (JS add may be string concatenation or
            numeric add, depending on the types of the operands.)
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
@@ -1548,7 +1495,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_add);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mul) {
@@ -1557,9 +1504,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Multiplies register src1 and register src2 (converted to
            numbers), and puts the product in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow
                 callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() * src2.asInt32());
         else {
@@ -1568,7 +1515,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_mul);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_div) {
@@ -1578,15 +1525,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register divisor (converted to number), and puts the
            quotient in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_div);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mod) {
@@ -1596,15 +1543,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register divisor (converted to number), and puts the
            remainder in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
             JSValue result = jsNumber(callFrame, dividend.asInt32() % divisor.asInt32());
             ASSERT(result);
             callFrame->r(dst) = result;
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_mod);
             NEXT_INSTRUCTION();
         }
 
@@ -1615,7 +1562,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue result = jsNumber(callFrame, fmod(d1, d2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_mod);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_sub) {
@@ -1625,9 +1572,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            src1 (converted to number), and puts the difference in
            register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
@@ -1635,7 +1582,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_sub);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_lshift) {
@@ -1645,9 +1592,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register shift (converted to uint32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() << (shift.asInt32() & 0x1f));
@@ -1657,7 +1604,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_lshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_rshift) {
@@ -1667,9 +1614,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            to int32) by register shift (converted to
            uint32), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
@@ -1679,7 +1626,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_rshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_urshift) {
@@ -1689,9 +1636,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            to uint32) by register shift (converted to
            uint32), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
         if (val.isUInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
@@ -1700,7 +1647,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_urshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitand) {
@@ -1710,9 +1657,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() & src2.asInt32());
         else {
@@ -1721,7 +1668,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitand);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitxor) {
@@ -1731,9 +1678,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() ^ src2.asInt32());
         else {
@@ -1742,7 +1689,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitxor);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitor) {
@@ -1752,9 +1699,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the
            result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() | src2.asInt32());
         else {
@@ -1763,7 +1710,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitor);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitnot) {
@@ -1772,8 +1719,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Computes bitwise NOT of register src1 (converted to int32),
            and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, ~src.asInt32());
         else {
@@ -1781,7 +1728,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_bitnot);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_not) {
@@ -1790,13 +1737,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Computes logical NOT of register src (converted to
            boolean), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         JSValue result = jsBoolean(!callFrame->r(src).jsValue().toBoolean(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_not);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_instanceof) {
@@ -1826,7 +1773,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = jsBoolean(result);
 
-        vPC += 5;
+        vPC += OPCODE_LENGTH(op_instanceof);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_typeof) {
@@ -1835,11 +1782,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Determines the type string for src according to ECMAScript
            rules, and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = JSValue(jsTypeStringForValue(callFrame, callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_typeof);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_undefined) {
@@ -1849,12 +1796,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "undefined", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         JSValue v = callFrame->r(src).jsValue();
         callFrame->r(dst) = jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_undefined);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_boolean) {
@@ -1864,11 +1811,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "boolean", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isBoolean());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_boolean);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_number) {
@@ -1878,11 +1825,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "number", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isNumber());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_number);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_string) {
@@ -1892,11 +1839,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "string", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isString());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_string);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_object) {
@@ -1906,11 +1853,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "object", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(jsIsObjectType(callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_object);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_function) {
@@ -1920,11 +1867,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "function", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(jsIsFunctionType(callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_function);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_in) {
@@ -1936,9 +1883,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Raises an exception if register constructor is not an
            object.
         */
-        int dst = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int base = vPC[3].u.operand;
 
         JSValue baseVal = callFrame->r(base).jsValue();
         if (isInvalidParamForIn(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
@@ -1957,7 +1904,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = jsBoolean(baseObj->hasProperty(callFrame, property));
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_in);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve) {
@@ -1970,7 +1917,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolve(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_resolve);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_skip) {
@@ -1983,7 +1930,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveSkip(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_resolve_skip);
 
         NEXT_INSTRUCTION();
     }
@@ -1998,7 +1945,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveGlobal(callFrame, vPC, exceptionValue)))
             goto vm_throw;
         
-        vPC += 6;
+        vPC += OPCODE_LENGTH(op_resolve_global);
         
         NEXT_INSTRUCTION();
     }
@@ -2007,13 +1954,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            Gets the global var at global slot index and places it in register dst.
          */
-        int dst = (++vPC)->u.operand;
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
+        int dst = vPC[1].u.operand;
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = (++vPC)->u.operand;
+        int index = vPC[3].u.operand;
 
         callFrame->r(dst) = scope->registerAt(index);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_global_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_global_var) {
@@ -2021,13 +1968,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          
            Puts value into global slot index.
          */
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[1].u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int index = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
         
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_global_var);
         NEXT_INSTRUCTION();
     }            
     DEFINE_OPCODE(op_get_scoped_var) {
@@ -2036,9 +1983,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          Loads the contents of the index-th local from the scope skip nodes from
          the top of the scope chain, and places it in register dst
          */
-        int dst = (++vPC)->u.operand;
-        int index = (++vPC)->u.operand;
-        int skip = (++vPC)->u.operand + callFrame->codeBlock()->needsFullScopeChain();
+        int dst = vPC[1].u.operand;
+        int index = vPC[2].u.operand;
+        int skip = vPC[3].u.operand + callFrame->codeBlock()->needsFullScopeChain();
 
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
@@ -2052,16 +1999,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         callFrame->r(dst) = scope->registerAt(index);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_scoped_var) {
         /* put_scoped_var index(n) skip(n) value(r)
 
          */
-        int index = (++vPC)->u.operand;
-        int skip = (++vPC)->u.operand + callFrame->codeBlock()->needsFullScopeChain();
-        int value = (++vPC)->u.operand;
+        int index = vPC[1].u.operand;
+        int skip = vPC[2].u.operand + callFrame->codeBlock()->needsFullScopeChain();
+        int value = vPC[3].u.operand;
 
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
@@ -2075,7 +2022,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_base) {
@@ -2088,7 +2035,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         resolveBase(callFrame, vPC);
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_resolve_base);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_with_base) {
@@ -2106,7 +2053,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveBaseAndProperty(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_resolve_with_base);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id) {
@@ -2129,7 +2076,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         tryCacheGetByID(callFrame, codeBlock, vPC, baseValue, ident, slot);
 
         callFrame->r(dst) = result;
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_self) {
@@ -2155,7 +2102,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                 callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_get_by_id_self);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2189,7 +2136,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
                     callFrame->r(dst) = JSValue(protoObject->getDirectOffset(offset));
 
-                    vPC += 8;
+                    vPC += OPCODE_LENGTH(op_get_by_id_proto);
                     NEXT_INSTRUCTION();
                 }
             }
@@ -2202,14 +2149,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         // Polymorphic self access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
         // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_self_list);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_proto_list) {
         // Polymorphic prototype access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
         // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_chain) {
@@ -2244,7 +2191,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                         callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
-                        vPC += 8;
+                        vPC += OPCODE_LENGTH(op_get_by_id_chain);
                         NEXT_INSTRUCTION();
                     }
 
@@ -2274,7 +2221,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         CHECK_FOR_EXCEPTION();
 
         callFrame->r(dst) = result;
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_generic);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_array_length) {
@@ -2290,7 +2237,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
             callFrame->r(dst) = jsNumber(callFrame, asArray(baseValue)->length());
-            vPC += 8;
+            vPC += OPCODE_LENGTH(op_get_array_length);
             NEXT_INSTRUCTION();
         }
 
@@ -2310,7 +2257,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
             callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
-            vPC += 8;
+            vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
 
@@ -2340,7 +2287,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         tryCachePutByID(callFrame, codeBlock, vPC, baseValue, slot);
 
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_put_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_id_transition) {
@@ -2385,7 +2332,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_put_by_id_transition);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2420,7 +2367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_put_by_id_replace);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2447,7 +2394,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         baseValue.put(callFrame, ident, callFrame->r(value).jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_put_by_id_generic);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_del_by_id) {
@@ -2458,16 +2405,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            boolean indicating success (if true) or failure (if false)
            to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame);
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_del_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_val) {
@@ -2478,9 +2425,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            in register dst. property is nominally converted to string
            but numbers are treated more efficiently.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
         
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
@@ -2508,7 +2455,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_val) {
@@ -2522,9 +2469,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
 
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
@@ -2558,7 +2505,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
 
         CHECK_FOR_EXCEPTION();
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_del_by_val) {
@@ -2569,9 +2516,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            boolean indicating success (if true) or failure (if false)
            to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame); // may throw
 
@@ -2589,7 +2536,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_del_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_index) {
@@ -2604,13 +2551,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            This opcode is mainly used to initialize array literals.
         */
-        int base = (++vPC)->u.operand;
-        unsigned property = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        unsigned property = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
 
         callFrame->r(base).jsValue().put(callFrame, property, callFrame->r(value).jsValue());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_by_index);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop) {
@@ -2625,7 +2572,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if ENABLE(OPCODE_STATS)
         OpcodeStats::resetLastInstruction();
 #endif
-        int target = (++vPC)->u.operand;
+        int target = vPC[1].u.operand;
         CHECK_FOR_TIMEOUT();
         vPC += target;
         NEXT_INSTRUCTION();
@@ -2639,7 +2586,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if ENABLE(OPCODE_STATS)
         OpcodeStats::resetLastInstruction();
 #endif
-        int target = (++vPC)->u.operand;
+        int target = vPC[1].u.operand;
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -2653,15 +2600,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             CHECK_FOR_TIMEOUT();
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jtrue) {
@@ -2670,14 +2617,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register cond converts to boolean as true.
         */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jtrue);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jfalse) {
@@ -2686,14 +2633,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register cond converts to boolean as false.
         */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jfalse);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jeq_null) {
@@ -2702,8 +2649,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register src is null.
         */
-        int src = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
         if (srcValue.isUndefinedOrNull() || (srcValue.isCell() && srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
@@ -2711,7 +2658,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jeq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jneq_null) {
@@ -2720,8 +2667,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register src is not null.
         */
-        int src = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
         if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
@@ -2729,7 +2676,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jneq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jneq_ptr) {
@@ -2738,16 +2685,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if the value r is equal
            to ptr, using pointer equality.
          */
-        int src = (++vPC)->u.operand;
-        JSValue ptr = JSValue((++vPC)->u.jsCell);
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        JSValue ptr = JSValue(vPC[2].u.jsCell);
+        int target = vPC[3].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
         if (srcValue != ptr) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jneq_ptr);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop_if_less) {
@@ -2761,9 +2708,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
         
         bool result = jsLess(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2774,7 +2721,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_less);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop_if_lesseq) {
@@ -2788,9 +2735,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
         
         bool result = jsLessEq(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2801,7 +2748,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_lesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jnless) {
@@ -2812,9 +2759,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            target from the current instruction, if and only if the 
            result of the comparison is false.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
 
         bool result = jsLess(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2824,7 +2771,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jnlesseq) {
@@ -2835,9 +2782,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and then jumps to offset target from the current instruction,
            if and only if theresult of the comparison is false.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
 
         bool result = jsLessEq(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2847,7 +2794,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jnlesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_switch_imm) {
@@ -2859,9 +2806,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            table, and the value at jumpTable[scrutinee value] is non-zero, then
            that value is used as the jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (scrutinee.isInt32())
             vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.asInt32(), defaultOffset);
         else {
@@ -2883,9 +2830,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            table, and the value at jumpTable[scrutinee value] is non-zero, then
            that value is used as the jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
@@ -2906,9 +2853,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            jump table, then the value associated with the string is used as the 
            jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
@@ -2923,12 +2870,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor, using the rules for function declarations, and
            puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int func = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int func = vPC[2].u.operand;
 
         callFrame->r(dst) = JSValue(callFrame->codeBlock()->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_func);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func_exp) {
@@ -2939,8 +2886,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor, using the rules for function expressions, and
            puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int funcIndex = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int funcIndex = vPC[2].u.operand;
 
         FunctionExecutable* function = callFrame->codeBlock()->functionExpr(funcIndex);
         JSFunction* func = function->make(callFrame, callFrame->scopeChain());
@@ -2959,7 +2906,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         callFrame->r(dst) = JSValue(func);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_func_exp);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_call_eval) {
@@ -2992,7 +2939,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 goto vm_throw;
             callFrame->r(dst) = result;
 
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call_eval);
             NEXT_INSTRUCTION();
         }
 
@@ -3066,7 +3013,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
             callFrame->r(dst) = returnValue;
 
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call);
             NEXT_INSTRUCTION();
         }
 
@@ -3076,8 +3023,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         goto vm_throw;
     }
     DEFINE_OPCODE(op_load_varargs) {
-        int argCountDst = (++vPC)->u.operand;
-        int argsOffset = (++vPC)->u.operand;
+        int argCountDst = vPC[1].u.operand;
+        int argsOffset = vPC[2].u.operand;
         
         JSValue arguments = callFrame->r(argsOffset).jsValue();
         int32_t argCount = 0;
@@ -3149,7 +3096,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
         CHECK_FOR_EXCEPTION();
         callFrame->r(argCountDst) = Register::withInt(argCount + 1);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_load_varargs);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_call_varargs) {
@@ -3220,7 +3167,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             
             callFrame->r(dst) = returnValue;
             
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call_varargs);
             NEXT_INSTRUCTION();
         }
         
@@ -3242,12 +3189,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            This opcode should only be used immediately before op_ret.
         */
 
-        int src = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
         ASSERT(callFrame->codeBlock()->needsFullScopeChain());
 
         asActivation(callFrame->r(src).jsValue())->copyRegisters(callFrame->optionalCalleeArguments());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_tear_off_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_tear_off_arguments) {
@@ -3268,7 +3215,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (callFrame->optionalCalleeArguments())
             callFrame->optionalCalleeArguments()->copyRegisters();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_tear_off_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_ret) {
@@ -3281,7 +3228,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register base to those of the calling function.
         */
 
-        int result = (++vPC)->u.operand;
+        int result = vPC[1].u.operand;
 
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
@@ -3316,7 +3263,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         for (size_t count = codeBlock->m_numVars; i < count; ++i)
             callFrame->r(i) = jsUndefined();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_enter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_enter_with_activation) {
@@ -3338,12 +3285,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         for (size_t count = codeBlock->m_numVars; i < count; ++i)
             callFrame->r(i) = jsUndefined();
 
-        int dst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
         JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
         callFrame->r(dst) = JSValue(activation);
         callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_enter_with_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_convert_this) {
@@ -3358,12 +3305,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            block.
         */
 
-        int thisRegister = (++vPC)->u.operand;
+        int thisRegister = vPC[1].u.operand;
         JSValue thisVal = callFrame->r(thisRegister).jsValue();
         if (thisVal.needsThisConversion())
             callFrame->r(thisRegister) = JSValue(thisVal.toThisObject(callFrame));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_convert_this);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_init_arguments) {
@@ -3377,7 +3324,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            block.
          */
         callFrame->r(RegisterFile::ArgumentsRegister) = JSValue();
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_init_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_create_arguments) {
@@ -3393,7 +3340,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
              callFrame->setCalleeArguments(arguments);
              callFrame->r(RegisterFile::ArgumentsRegister) = JSValue(arguments);
          }
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_create_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_construct) {
@@ -3471,7 +3418,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = JSValue(returnValue);
 
-            vPC += 7;
+            vPC += OPCODE_LENGTH(op_construct);
             NEXT_INSTRUCTION();
         }
 
@@ -3489,32 +3436,32 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         int dst = vPC[1].u.operand;
         if (LIKELY(callFrame->r(dst).jsValue().isObject())) {
-            vPC += 3;
+            vPC += OPCODE_LENGTH(op_construct_verify);
             NEXT_INSTRUCTION();
         }
 
         int override = vPC[2].u.operand;
         callFrame->r(dst) = callFrame->r(override);
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_construct_verify);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_strcat) {
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
-        int count = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
+        int count = vPC[3].u.operand;
 
         callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_to_primitive) {
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
 
         callFrame->r(dst) = callFrame->r(src).jsValue().toPrimitive(callFrame);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_to_primitive);
 
         NEXT_INSTRUCTION();
     }
@@ -3525,7 +3472,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            of the current scope chain.  The contents of the register scope
            are replaced by the result of toObject conversion of the scope.
         */
-        int scope = (++vPC)->u.operand;
+        int scope = vPC[1].u.operand;
         JSValue v = callFrame->r(scope).jsValue();
         JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
@@ -3533,7 +3480,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         callFrame->r(scope) = JSValue(o);
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_push_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pop_scope) {
@@ -3543,47 +3490,69 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         callFrame->setScopeChain(callFrame->scopeChain()->pop());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pop_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_pnames) {
-        /* get_pnames dst(r) base(r)
+        /* get_pnames dst(r) base(r) i(n) size(n) breakTarget(offset)
 
            Creates a property name list for register base and puts it
-           in register dst. This is not a true JavaScript value, just
-           a synthetic value used to keep the iteration state in a
-           register.
+           in register dst, initializing i and size for iteration. If
+           base is undefined or null, jumps to breakTarget.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int i = vPC[3].u.operand;
+        int size = vPC[4].u.operand;
+        int breakTarget = vPC[5].u.operand;
+
+        JSValue v = callFrame->r(base).jsValue();
+        if (v.isUndefinedOrNull()) {
+            vPC += breakTarget;
+            NEXT_INSTRUCTION();
+        }
+
+        JSObject* o = v.toObject(callFrame);
+        Structure* structure = o->structure();
+        JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+        if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(callFrame))
+            jsPropertyNameIterator = JSPropertyNameIterator::create(callFrame, o);
 
-        callFrame->r(dst) = JSPropertyNameIterator::create(callFrame, callFrame->r(base).jsValue());
-        ++vPC;
+        callFrame->r(dst) = jsPropertyNameIterator;
+        callFrame->r(base) = JSValue(o);
+        callFrame->r(i) = Register::withInt(0);
+        callFrame->r(size) = Register::withInt(jsPropertyNameIterator->size());
+        vPC += OPCODE_LENGTH(op_get_pnames);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_next_pname) {
-        /* next_pname dst(r) iter(r) target(offset)
+        /* next_pname dst(r) base(r) i(n) size(n) iter(r) target(offset)
 
-           Tries to copies the next name from property name list in
-           register iter. If there are names left, then copies one to
-           register dst, and jumps to offset target. If there are none
-           left, invalidates the iterator and continues to the next
+           Copies the next name from the property name list in
+           register iter to dst, then jumps to offset target. If there are no
+           names left, invalidates the iterator and continues to the next
            instruction.
         */
-        int dst = (++vPC)->u.operand;
-        int iter = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int i = vPC[3].u.operand;
+        int size = vPC[4].u.operand;
+        int iter = vPC[5].u.operand;
+        int target = vPC[6].u.operand;
 
         JSPropertyNameIterator* it = callFrame->r(iter).propertyNameIterator();
-        if (JSValue temp = it->next(callFrame)) {
-            CHECK_FOR_TIMEOUT();
-            callFrame->r(dst) = JSValue(temp);
-            vPC += target;
-            NEXT_INSTRUCTION();
+        while (callFrame->r(i).i() != callFrame->r(size).i()) {
+            JSValue key = it->get(callFrame, asObject(callFrame->r(base).jsValue()), callFrame->r(i).i());
+            callFrame->r(i) = Register::withInt(callFrame->r(i).i() + 1);
+            if (key) {
+                CHECK_FOR_TIMEOUT();
+                callFrame->r(dst) = key;
+                vPC += target;
+                NEXT_INSTRUCTION();
+            }
         }
-        it->invalidate();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_next_pname);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jmp_scopes) {
@@ -3593,8 +3562,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            specified by immediate number count, then jumps to offset
            target.
         */
-        int count = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int count = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
 
         ScopeChainNode* tmp = callFrame->scopeChain();
         while (count--)
@@ -3617,7 +3586,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          */
         callFrame->setScopeChain(createExceptionScope(callFrame, vPC));
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_push_new_scope);
         NEXT_INSTRUCTION();
     }
 #if HAVE(COMPUTED_GOTO)
@@ -3632,11 +3601,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         ASSERT(exceptionValue);
         ASSERT(!globalData->exception);
-        int ex = (++vPC)->u.operand;
+        int ex = vPC[1].u.operand;
         callFrame->r(ex) = exceptionValue;
         exceptionValue = JSValue();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_catch);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_throw) {
@@ -3650,7 +3619,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            else the script returns control to the nearest native caller.
         */
 
-        int ex = (++vPC)->u.operand;
+        int ex = vPC[1].u.operand;
         exceptionValue = callFrame->r(ex).jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - callFrame->codeBlock()->instructions().begin(), true);
@@ -3670,14 +3639,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constant message as the message string. The result is
            written to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int type = (++vPC)->u.operand;
-        int message = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int type = vPC[2].u.operand;
+        int message = vPC[3].u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
         callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_error);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_end) {
@@ -3692,7 +3661,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ASSERT(scopeChain->refCount > 1);
             scopeChain->deref();
         }
-        int result = (++vPC)->u.operand;
+        int result = vPC[1].u.operand;
         return callFrame->r(result).jsValue();
     }
     DEFINE_OPCODE(op_put_getter) {
@@ -3706,9 +3675,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int function = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int function = vPC[3].u.operand;
 
         ASSERT(callFrame->r(base).jsValue().isObject());
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
@@ -3716,7 +3685,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(callFrame->r(function).jsValue().isObject());
         baseObj->defineGetter(callFrame, ident, asObject(callFrame->r(function).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_getter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_setter) {
@@ -3730,9 +3699,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int function = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int function = vPC[3].u.operand;
 
         ASSERT(callFrame->r(base).jsValue().isObject());
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
@@ -3740,7 +3709,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(callFrame->r(function).jsValue().isObject());
         baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()), 0);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_setter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_method_check) {
@@ -3753,9 +3722,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Places the address of the next instruction into the retAddrDst
            register and jumps to offset target from the current instruction.
         */
-        int retAddrDst = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
-        callFrame->r(retAddrDst) = vPC + 1;
+        int retAddrDst = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        callFrame->r(retAddrDst) = vPC + OPCODE_LENGTH(op_jsr);
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -3767,7 +3736,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          differs from op_jmp because the target address is stored in a
          register, not as an immediate.
         */
-        int retAddrSrc = (++vPC)->u.operand;
+        int retAddrSrc = vPC[1].u.operand;
         vPC = callFrame->r(retAddrSrc).vPC();
         NEXT_INSTRUCTION();
     }
@@ -3777,13 +3746,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          Notifies the debugger of the current state of execution. This opcode
          is only generated while the debugger is attached.
         */
-        int debugHookID = (++vPC)->u.operand;
-        int firstLine = (++vPC)->u.operand;
-        int lastLine = (++vPC)->u.operand;
+        int debugHookID = vPC[1].u.operand;
+        int firstLine = vPC[2].u.operand;
+        int lastLine = vPC[3].u.operand;
 
         debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_debug);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_profile_will_call) {
@@ -3797,7 +3766,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (*enabledProfilerReference)
             (*enabledProfilerReference)->willExecute(callFrame, callFrame->r(function).jsValue());
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_profile_will_call);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_profile_did_call) {
@@ -3811,7 +3780,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (*enabledProfilerReference)
             (*enabledProfilerReference)->didExecute(callFrame, callFrame->r(function).jsValue());
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_profile_did_call);
         NEXT_INSTRUCTION();
     }
     vm_throw: {
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 3046b28..e17b055 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -129,7 +129,6 @@ namespace JSC {
         NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
         NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
 
         void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 3274fcc..1d15ef0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -78,6 +78,9 @@ private:
     struct Allocation {
         char* pages;
         size_t size;
+#if PLATFORM(SYMBIAN)
+        RChunk* chunk;
+#endif
     };
     typedef Vector<Allocation, 2> AllocationList;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
new file mode 100644
index 0000000..c96ecae
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, 
+ *  Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+
+#include "ExecutableAllocator.h"
+
+#if ENABLE(ASSEMBLER) && PLATFORM(SYMBIAN)
+
+#include <e32hal.h>
+#include <e32std.h>
+
+// Set the page size to 256 Kb to compensate for moving memory model limitation
+const size_t MOVING_MEM_PAGE_SIZE = 256 * 1024; 
+
+namespace JSC {
+
+void ExecutableAllocator::intializePageSize()
+{
+#if PLATFORM_ARM_ARCH(5)
+    // The moving memory model (as used in ARMv5 and earlier platforms)
+    // on Symbian OS limits the number of chunks for each process to 16. 
+    // To mitigate this limitation increase the pagesize to 
+    // allocate less of larger chunks.
+    ExecutableAllocator::pageSize = MOVING_MEM_PAGE_SIZE;
+#else
+    TInt page_size;
+    UserHal::PageSizeInBytes(page_size);
+    ExecutableAllocator::pageSize = page_size;
+#endif
+}
+
+ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
+{
+    RChunk* codeChunk = new RChunk();
+
+    TInt errorCode = codeChunk->CreateLocalCode(n, n);
+
+    char* allocation = reinterpret_cast<char*>(codeChunk->Base());
+    if (!allocation)
+        CRASH();
+    ExecutablePool::Allocation alloc = { allocation, n, codeChunk };
+    return alloc;
+}
+
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
+{ 
+    alloc.chunk->Close();
+    delete alloc.chunk;
+}
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
+#endif
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index ea8434e..fa0ac2e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -202,7 +202,6 @@ void JIT::privateCompileMainPass()
         DEFINE_BINARY_OP(op_less)
         DEFINE_BINARY_OP(op_lesseq)
         DEFINE_BINARY_OP(op_urshift)
-        DEFINE_UNARY_OP(op_get_pnames)
         DEFINE_UNARY_OP(op_is_boolean)
         DEFINE_UNARY_OP(op_is_function)
         DEFINE_UNARY_OP(op_is_number)
@@ -241,6 +240,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_get_by_id)
         DEFINE_OP(op_get_by_val)
         DEFINE_OP(op_get_global_var)
+        DEFINE_OP(op_get_pnames)
         DEFINE_OP(op_get_scoped_var)
         DEFINE_OP(op_instanceof)
         DEFINE_OP(op_jeq_null)
@@ -489,21 +489,21 @@ JITCode JIT::privateCompile()
             ASSERT(record.type == SwitchRecord::Immediate || record.type == SwitchRecord::Character); 
             ASSERT(record.jumpTable.simpleJumpTable->branchOffsets.size() == record.jumpTable.simpleJumpTable->ctiOffsets.size());
 
-            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + record.defaultOffset]);
 
             for (unsigned j = 0; j < record.jumpTable.simpleJumpTable->branchOffsets.size(); ++j) {
                 unsigned offset = record.jumpTable.simpleJumpTable->branchOffsets[j];
-                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
+                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
             }
         } else {
             ASSERT(record.type == SwitchRecord::String);
 
-            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + record.defaultOffset]);
 
             StringJumpTable::StringOffsetTable::iterator end = record.jumpTable.stringJumpTable->offsetTable.end();            
             for (StringJumpTable::StringOffsetTable::iterator it = record.jumpTable.stringJumpTable->offsetTable.begin(); it != end; ++it) {
                 unsigned offset = it->second.branchOffset;
-                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
+                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
             }
         }
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index 0712743..9406d1f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -386,6 +386,8 @@ namespace JSC {
 
         Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
+        void testPrototype(Structure*, JumpList& failureCases);
+
 #if USE(JSVALUE32_64)
         Address tagFor(unsigned index, RegisterID base = callFrameRegister);
         Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
@@ -713,6 +715,7 @@ namespace JSC {
         void emit_op_new_func_exp(Instruction*);
         void emit_op_new_object(Instruction*);
         void emit_op_new_regexp(Instruction*);
+        void emit_op_get_pnames(Instruction*);
         void emit_op_next_pname(Instruction*);
         void emit_op_not(Instruction*);
         void emit_op_nstricteq(Instruction*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 7afc1f2..8cda482 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -98,16 +98,16 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target);
     }
 
     if (!supportsFloatingPoint()) {
@@ -145,7 +145,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
@@ -161,16 +161,16 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, regT2), target + 3);
+        addJump(branch32(GreaterThan, regT0, regT2), target);
     }
 
     if (!supportsFloatingPoint()) {
@@ -208,7 +208,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
 // LeftShift (<<)
@@ -829,11 +829,11 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst + 3);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst + 3);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +882,11 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst + 3);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst + 3);
+                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1313,7 +1313,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
@@ -1322,13 +1322,13 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target + 3);
+        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
 
-        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target);
     }
 }
 
@@ -1365,7 +1365,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1382,7 +1382,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
@@ -1406,7 +1406,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1423,7 +1423,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else {
         linkSlowCase(iter);
@@ -1452,7 +1452,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1475,7 +1475,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
     }
 }
 
@@ -1498,7 +1498,7 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
@@ -1507,13 +1507,13 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target + 3);
+        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
 
-        addJump(branch32(GreaterThan, regT0, regT1), target + 3);
+        addJump(branch32(GreaterThan, regT0, regT1), target);
     }
 }
 
@@ -1550,7 +1550,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1567,7 +1567,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
@@ -1591,7 +1591,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1608,7 +1608,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else {
         linkSlowCase(iter);
@@ -1637,7 +1637,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1660,7 +1660,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
     }
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index 4fd24d2..cfaa69f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -236,19 +236,17 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    Jump wasEval1;
-    Jump wasEval2;
+    Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
         stubCall.addArgument(callee);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval1 = branchTest32(NonZero, regT0);
-        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
     }
 
-    emitLoad(callee, regT1, regT2);
+    emitLoad(callee, regT1, regT0);
 
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -256,12 +254,12 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
         JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitLoad(callee, regT1, regT2);
+        emitLoad(callee, regT1, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -271,12 +269,10 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
 
     emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
-    if (opcodeID == op_call_eval) {
-        wasEval1.link(this);
-        wasEval2.link(this);
-    }
+    if (opcodeID == op_call_eval)
+        wasEval.link(this);
 
-    emitStore(dst, regT1, regT0);;
+    emitStore(dst, regT1, regT0);
 
     sampleCodeBlock(m_codeBlock);
 }
@@ -306,16 +302,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
 
-    Jump wasEval1;
-    Jump wasEval2;
+    Jump wasEval;
     if (opcodeID == op_call_eval) {
         JITStubCall stubCall(this, cti_op_call_eval);
         stubCall.addArgument(callee);
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval1 = branchTest32(NonZero, regT0);
-        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
@@ -359,10 +353,8 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Call to the callee
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
     
-    if (opcodeID == op_call_eval) {
-        wasEval1.link(this);
-        wasEval2.link(this);
-    }
+    if (opcodeID == op_call_eval)
+        wasEval.link(this);
 
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitStore(dst, regT1, regT0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index 7059cc8..e10d105 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -33,6 +33,7 @@
 #include "JSArray.h"
 #include "JSCell.h"
 #include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
 #include "LinkBuffer.h"
 
 namespace JSC {
@@ -248,10 +249,8 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
     // Check for an exception
-    // FIXME: Maybe we can optimize this comparison to JSValue().
     move(ImmPtr(&globalData->exception), regT2);
-    Jump sawException1 = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::CellTag));
-    Jump sawException2 = branch32(NonZero, payloadFor(0, regT2), Imm32(0));
+    Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
 
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT3);
@@ -264,13 +263,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     ret();
 
     // Handle an exception
-    sawException1.link(this);
-    sawException2.link(this);
+    sawException.link(this);
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     restoreReturnAddressBeforeReturn(regT2);
@@ -348,14 +346,14 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 void JIT::emit_op_jmp(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
     emitTimeoutCheck();
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
@@ -369,21 +367,21 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
     
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThan, regT0, regT2), target + 3);
+    addJump(branch32(LessThan, regT0, regT2), target);
 }
 
 void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -400,7 +398,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
@@ -414,21 +412,21 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThanOrEqual, regT0, regT2), target + 3);
+    addJump(branch32(LessThanOrEqual, regT0, regT2), target);
 }
 
 void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -445,7 +443,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_new_object(Instruction* currentInstruction)
@@ -460,30 +458,20 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     unsigned baseVal = currentInstruction[3].u.operand;
     unsigned proto = currentInstruction[4].u.operand;
 
-    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // Load the operands into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
-    emitLoadPayload(proto, regT1);
-    emitLoadPayload(baseVal, regT0);
     emitLoadPayload(value, regT2);
+    emitLoadPayload(baseVal, regT0);
+    emitLoadPayload(proto, regT1);
 
-    // Check that baseVal & proto are cells.
-    emitJumpSlowCaseIfNotJSCell(proto);
+    // Check that value, baseVal, and proto are cells.
+    emitJumpSlowCaseIfNotJSCell(value);
     emitJumpSlowCaseIfNotJSCell(baseVal);
+    emitJumpSlowCaseIfNotJSCell(proto);
 
-    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType))); // FIXME: Maybe remove this test.
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance))); // FIXME: TOT checks ImplementsDefaultHasInstance.
-
-    // If value is not an Object, return false.
-    emitLoadTag(value, regT0);
-    Jump valueIsImmediate = branch32(NotEqual, regT0, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)); // FIXME: Maybe remove this test.
-
-    // Check proto is object.
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -491,16 +479,14 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     move(Imm32(JSValue::TrueTag), regT0);
     Label loop(this);
 
-    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
-    branch32(NotEqual, regT2, Imm32(0), loop);
+    branchTest32(NonZero, regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    valueIsImmediate.link(this);
-    valueIsNotObject.link(this);
     move(Imm32(JSValue::FalseTag), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
@@ -515,11 +501,10 @@ void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCas
     unsigned baseVal = currentInstruction[3].u.operand;
     unsigned proto = currentInstruction[4].u.operand;
 
+    linkSlowCaseIfNotJSCell(iter, value);
     linkSlowCaseIfNotJSCell(iter, baseVal);
     linkSlowCaseIfNotJSCell(iter, proto);
     linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
 
     JITStubCall stubCall(this, cti_op_instanceof);
     stubCall.addArgument(value);
@@ -674,12 +659,12 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addJump(branch32(NotEqual, regT0, Imm32(0)), target + 2);
+    addJump(branch32(NotEqual, regT0, Imm32(0)), target);
     Jump isNotZero = jump();
 
     isNotInteger.link(this);
 
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
 
     isNotZero.link(this);
@@ -695,7 +680,7 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
@@ -788,11 +773,11 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
@@ -801,7 +786,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target + 2);
+        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -818,7 +803,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 2); // Inverted.
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target); // Inverted.
 }
 
 void JIT::emit_op_jtrue(Instruction* currentInstruction)
@@ -829,11 +814,11 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isFalse = branch32(Equal, regT1, Imm32(JSValue::FalseTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
@@ -842,7 +827,7 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target + 2);
+        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -859,7 +844,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
@@ -873,7 +858,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -884,7 +869,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
-    addJump(branchTest32(NonZero, regT1), target + 2);
+    addJump(branchTest32(NonZero, regT1), target);
 
     wasNotImmediate.link(this);
 }
@@ -900,7 +885,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -911,7 +896,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
-    addJump(branchTest32(Zero, regT1), target + 2);
+    addJump(branchTest32(Zero, regT1), target);
 
     wasNotImmediate.link(this);
 }
@@ -923,8 +908,8 @@ void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
     unsigned target = currentInstruction[3].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target + 3);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target + 3);
+    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
@@ -932,7 +917,7 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
     DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
 }
 
@@ -1198,23 +1183,109 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 #endif
 }
 
+void JIT::emit_op_get_pnames(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int breakTarget = currentInstruction[5].u.operand;
+
+    JumpList isNotObject;
+
+    emitLoad(base, regT1, regT0);
+    if (!m_codeBlock->isKnownNotImmediate(base))
+        isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    if (base != m_codeBlock->thisRegister()) {
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    }
+
+    // We could inline the case where you have a valid cache, but
+    // this call doesn't seem to be hot.
+    Label isObject(this);
+    JITStubCall getPnamesStubCall(this, cti_op_get_pnames);
+    getPnamesStubCall.addArgument(regT0);
+    getPnamesStubCall.call(dst);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
+    store32(Imm32(0), addressFor(i));
+    store32(regT3, addressFor(size));
+    Jump end = jump();
+
+    isNotObject.link(this);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::NullTag)), breakTarget);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::UndefinedTag)), breakTarget);
+    JITStubCall toObjectStubCall(this, cti_to_object);
+    toObjectStubCall.addArgument(regT1, regT0);
+    toObjectStubCall.call(base);
+    jump().linkTo(isObject, this);
+    
+    end.link(this);
+}
+
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
-    int iter = currentInstruction[2].u.operand;
-    int target = currentInstruction[3].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int it = currentInstruction[5].u.operand;
+    int target = currentInstruction[6].u.operand;
+    
+    JumpList callHasProperty;
+
+    Label begin(this);
+    load32(addressFor(i), regT0);
+    Jump end = branch32(Equal, regT0, addressFor(size));
+
+    // Grab key @ i
+    loadPtr(addressFor(it), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+    load32(BaseIndex(regT2, regT0, TimesEight), regT2);
+    store32(Imm32(JSValue::CellTag), tagFor(dst));
+    store32(regT2, payloadFor(dst));
 
-    load32(Address(callFrameRegister, (iter * sizeof(Register))), regT0);
+    // Increment i
+    add32(Imm32(1), regT0);
+    store32(regT0, addressFor(i));
+
+    // Verify that i is valid:
+    loadPtr(addressFor(base), regT0);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 
-    JITStubCall stubCall(this, cti_op_next_pname);
+    // Test base's prototype chain
+    loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
+    addJump(branchTestPtr(Zero, Address(regT3)), target);
+
+    Label checkPrototype(this);
+    callHasProperty.append(branch32(Equal, Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::NullTag)));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
+    addPtr(Imm32(sizeof(Structure*)), regT3);
+    branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
+
+    // Continue loop.
+    addJump(jump(), target);
+
+    // Slow case: Ask the object if i is valid.
+    callHasProperty.link(this);
+    loadPtr(addressFor(dst), regT1);
+    JITStubCall stubCall(this, cti_has_property);
     stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
     stubCall.call();
 
-    Jump endOfIter = branchTestPtr(Zero, regT0);
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_next_pname), dst, regT1, regT0);
-    addJump(jump(), target + 3);
-    endOfIter.link(this);
+    // Test for valid key.
+    addJump(branchTest32(NonZero, regT0), target);
+    jump().linkTo(begin, this);
+
+    // End of loop.
+    end.link(this);
 }
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
@@ -1237,7 +1308,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump isInt32 = branch32(Equal, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::DeletedValueTag)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::EmptyValueTag)));
     isInt32.link(this);
 
     if (src != dst)
@@ -1284,7 +1355,7 @@ void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
     JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
-    addJump(jump(), currentInstruction[2].u.operand + 2);
+    addJump(jump(), currentInstruction[2].u.operand);
 }
 
 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
@@ -1381,8 +1452,7 @@ void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
 
 void JIT::emit_op_create_arguments(Instruction*)
 {
-    Jump argsNotCell = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::CellTag));
-    Jump argsNotNull = branchTestPtr(NonZero, payloadFor(RegisterFile::ArgumentsRegister, callFrameRegister));
+    Jump argsCreated = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::EmptyValueTag));
 
     // If we get here the arguments pointer is a null cell - i.e. arguments need lazy creation.
     if (m_codeBlock->m_numParameters == 1)
@@ -1390,8 +1460,7 @@ void JIT::emit_op_create_arguments(Instruction*)
     else
         JITStubCall(this, cti_op_create_arguments).call();
 
-    argsNotCell.link(this);
-    argsNotNull.link(this);
+    argsCreated.link(this);
 }
     
 void JIT::emit_op_init_arguments(Instruction*)
@@ -1754,7 +1823,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     restoreReturnAddressBeforeReturn(regT2);
@@ -1830,8 +1899,8 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 void JIT::emit_op_jmp(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
-    RECORD_JUMP_TARGET(target + 1);
+    addJump(jump(), target);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_loop(Instruction* currentInstruction)
@@ -1839,7 +1908,7 @@ void JIT::emit_op_loop(Instruction* currentInstruction)
     emitTimeoutCheck();
 
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
@@ -1857,7 +1926,7 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -1866,12 +1935,12 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThan, regT0, regT1), target + 3);
+        addJump(branch32(LessThan, regT0, regT1), target);
     }
 }
 
@@ -1890,12 +1959,12 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, regT1), target);
     }
 }
 
@@ -1906,30 +1975,26 @@ void JIT::emit_op_new_object(Instruction* currentInstruction)
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
 {
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
     // Load the operands (baseVal, proto, and value respectively) into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
-    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
-    emitGetVirtualRegister(currentInstruction[2].u.operand, regT2);
+    emitGetVirtualRegister(value, regT2);
+    emitGetVirtualRegister(baseVal, regT0);
+    emitGetVirtualRegister(proto, regT1);
 
     // Check that baseVal & proto are cells.
-    emitJumpSlowCaseIfNotJSCell(regT0);
-    emitJumpSlowCaseIfNotJSCell(regT1);
+    emitJumpSlowCaseIfNotJSCell(regT2, value);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVal);
+    emitJumpSlowCaseIfNotJSCell(regT1, proto);
 
-    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
-    // If value is not an Object, return false.
-    Jump valueIsImmediate = emitJumpIfNotJSCell(regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-
-    // Check proto is object.
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
-
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
@@ -1941,16 +2006,14 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
-    branchPtr(NotEqual, regT2, ImmPtr(JSValue::encode(jsNull())), loop);
+    emitJumpIfJSCell(regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    valueIsImmediate.link(this);
-    valueIsNotObject.link(this);
     move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_new_func(Instruction* currentInstruction)
@@ -2127,9 +2190,9 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+    addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
@@ -2196,14 +2259,14 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target);
     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
 
     isNonZero.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 };
 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 {
@@ -2215,16 +2278,16 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
     andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 };
 void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 {
@@ -2236,16 +2299,16 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
     andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
@@ -2255,9 +2318,9 @@ void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
     unsigned target = currentInstruction[3].u.operand;
     
     emitGetVirtualRegister(src, regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target + 3);            
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target);            
 
-    RECORD_JUMP_TARGET(target + 3);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
@@ -2265,10 +2328,10 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
     DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
     killLastResultRegister();
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_sret(Instruction* currentInstruction)
@@ -2320,13 +2383,13 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+    addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_neq(Instruction* currentInstruction)
@@ -2377,15 +2440,110 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 #endif
 }
 
+void JIT::emit_op_get_pnames(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int breakTarget = currentInstruction[5].u.operand;
+
+    JumpList isNotObject;
+
+    emitGetVirtualRegister(base, regT0);
+    if (!m_codeBlock->isKnownNotImmediate(base))
+        isNotObject.append(emitJumpIfNotJSCell(regT0));
+    if (base != m_codeBlock->thisRegister()) {
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    }
+
+    // We could inline the case where you have a valid cache, but
+    // this call doesn't seem to be hot.
+    Label isObject(this);
+    JITStubCall getPnamesStubCall(this, cti_op_get_pnames);
+    getPnamesStubCall.addArgument(regT0);
+    getPnamesStubCall.call(dst);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
+    store32(Imm32(0), addressFor(i));
+    store32(regT3, addressFor(size));
+    Jump end = jump();
+
+    isNotObject.link(this);
+    move(regT0, regT1);
+    and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
+    addJump(branch32(Equal, regT1, Imm32(JSImmediate::FullTagTypeNull)), breakTarget);
+
+    JITStubCall toObjectStubCall(this, cti_to_object);
+    toObjectStubCall.addArgument(regT0);
+    toObjectStubCall.call(base);
+    jump().linkTo(isObject, this);
+    
+    end.link(this);
+}
+
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_next_pname);
-    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int it = currentInstruction[5].u.operand;
+    int target = currentInstruction[6].u.operand;
+    
+    JumpList callHasProperty;
+
+    Label begin(this);
+    load32(addressFor(i), regT0);
+    Jump end = branch32(Equal, regT0, addressFor(size));
+
+    // Grab key @ i
+    loadPtr(addressFor(it), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+    loadPtr(BaseIndex(regT2, regT0, TimesEight), regT2);
+    emitPutVirtualRegister(dst, regT2);
+
+    // Increment i
+    add32(Imm32(1), regT0);
+    store32(regT0, addressFor(i));
+
+    // Verify that i is valid:
+    emitGetVirtualRegister(base, regT0);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
+
+    // Test base's prototype chain
+    loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
+    addJump(branchTestPtr(Zero, Address(regT3)), target);
+
+    Label checkPrototype(this);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    callHasProperty.append(emitJumpIfNotJSCell(regT2));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
+    addPtr(Imm32(sizeof(Structure*)), regT3);
+    branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
+
+    // Continue loop.
+    addJump(jump(), target);
+
+    // Slow case: Ask the object if i is valid.
+    callHasProperty.link(this);
+    emitGetVirtualRegister(dst, regT1);
+    JITStubCall stubCall(this, cti_has_property);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
     stubCall.call();
-    Jump endOfIter = branchTestPtr(Zero, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
-    addJump(jump(), currentInstruction[3].u.operand + 3);
-    endOfIter.link(this);
+
+    // Test for valid key.
+    addJump(branchTest32(NonZero, regT0), target);
+    jump().linkTo(begin, this);
+
+    // End of loop.
+    end.link(this);
 }
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
@@ -2469,8 +2627,8 @@ void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
     JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
-    addJump(jump(), currentInstruction[2].u.operand + 2);
-    RECORD_JUMP_TARGET(currentInstruction[2].u.operand + 2);
+    addJump(jump(), currentInstruction[2].u.operand);
+    RECORD_JUMP_TARGET(currentInstruction[2].u.operand);
 }
 
 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
@@ -2696,32 +2854,20 @@ void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowC
 
 void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
-    Label beginGetByValSlow(this);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
 
-    Jump notImm = getSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithIntToImmNoCheck(regT1, regT1);
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
 
-    notImm.link(this);
     JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(regT0);
-    stubCall.addArgument(regT1);
-    stubCall.call(currentInstruction[1].u.operand);
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    // This is slow void JIT::emitSlow_that handles accesses to arrays above the fast cut-off.
-    // First, check if this is an access to the vector
-    linkSlowCase(iter);
-    branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), beginGetByValSlow);
-
-    // okay, missed the fast region, but it is still in the vector.  Get the value.
-    loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT2);
-    // Check whether the value loaded is zero; if so we need to return undefined.
-    branchTestPtr(Zero, regT2, beginGetByValSlow);
-    move(regT2, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+    stubCall.addArgument(base, regT2);
+    stubCall.addArgument(property, regT2);
+    stubCall.call(dst);
 }
 
 void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2735,14 +2881,14 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
         JITStubCall stubCall(this, cti_op_loop_if_less);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
@@ -2750,7 +2896,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     }
 }
 
@@ -2764,7 +2910,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
         stubCall.addArgument(regT0);
         stubCall.addArgument(currentInstruction[2].u.operand, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
@@ -2772,36 +2918,26 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     }
 }
 
 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    // Normal slow cases - either is not an immediate imm, or is an array.
-    Jump notImm = getSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithIntToImmNoCheck(regT1, regT1);
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
 
-    notImm.link(this); {
-        JITStubCall stubCall(this, cti_op_put_by_val);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-        stubCall.call();
-        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
-    }
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
 
-    // slow cases for immediate int accesses to arrays
-    linkSlowCase(iter);
-    linkSlowCase(iter); {
-        JITStubCall stubCall(this, cti_op_put_by_val_array);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-        stubCall.call();
-    }
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(regT0);
+    stubPutByValCall.addArgument(property, regT2);
+    stubPutByValCall.addArgument(value, regT2);
+    stubPutByValCall.call();
 }
 
 void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2810,7 +2946,7 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2828,7 +2964,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand); // inverted!
 }
 
 void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2845,7 +2981,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
 void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2911,16 +3047,20 @@ void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCase
 
 void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, value);
+    linkSlowCaseIfNotJSCell(iter, baseVal);
+    linkSlowCaseIfNotJSCell(iter, proto);
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_instanceof);
-    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
-    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-    stubCall.addArgument(currentInstruction[4].u.operand, regT2);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.addArgument(value, regT2);
+    stubCall.addArgument(baseVal, regT2);
+    stubCall.addArgument(proto, regT2);
+    stubCall.call(dst);
 }
 
 void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index 08b3096..4241111 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -273,11 +273,14 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+
     emitStore(dst, regT1, regT0);
     map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
 }
@@ -288,35 +291,16 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     unsigned base = currentInstruction[2].u.operand;
     unsigned property = currentInstruction[3].u.operand;
 
-    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
-    Label callGetByValJITStub(this);
-
     linkSlowCase(iter); // property int32 check
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
 
     JITStubCall stubCall(this, cti_op_get_by_val);
     stubCall.addArgument(base);
     stubCall.addArgument(property);
     stubCall.call(dst);
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    linkSlowCase(iter); // array fast cut-off check
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), callGetByValJITStub);
-
-    // Missed the fast region, but it is still in the vector.
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-
-    // FIXME: Maybe we can optimize this comparison to JSValue().
-    Jump skip = branch32(NotEqual, regT0, Imm32(0));
-    branch32(Equal, regT1, Imm32(JSValue::CellTag), callGetByValJITStub);
-
-    skip.link(this);
-    emitStore(dst, regT1, regT0);
 }
 
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
@@ -330,24 +314,27 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-
-    Jump inFastVector = branch32(Below, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-
-    // Check if the access is within the vector.
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    Jump skip = branch32(NotEqual, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::CellTag));
-    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), Imm32(0)));
-    skip.link(this);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
 
-    inFastVector.link(this);
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
 
+    Label storeResult(this);
     emitLoad(value, regT1, regT0);
     store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
     store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+    Jump end = jump();
+
+    empty.link(this);
+    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+
+    add32(Imm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
 }
 
 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -359,24 +346,13 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCase(iter); // property int32 check
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
 
     JITStubCall stubPutByValCall(this, cti_op_put_by_val);
     stubPutByValCall.addArgument(base);
     stubPutByValCall.addArgument(property);
     stubPutByValCall.addArgument(value);
     stubPutByValCall.call();
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-    // Slow cases for immediate int accesses to arrays.
-    linkSlowCase(iter); // in vector check
-    linkSlowCase(iter); // written to slot check
-
-    JITStubCall stubCall(this, cti_op_put_by_val_array);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(regT2);
-    stubCall.addArgument(value);
-    stubCall.call();
 }
 
 void JIT::emit_op_get_by_id(Instruction* currentInstruction)
@@ -545,22 +521,26 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     load32(Address(temp, offset + 4), resultTag);
 }
 
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
 
     JumpList failureCases;
     failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(oldStructure)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    testPrototype(oldStructure, failureCases);
 
     // Verify that nothing in the prototype chain has a setter for this property. 
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(it->get())));
-    }
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
 
     // Reallocate property storage if needed.
     Call callTarget;
@@ -958,12 +938,16 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(JSVALUE64)
     // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
-    // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
-    // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
+    // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
+    // number was signed since m_vectorLength is always less than intmax (since the total allocation
     // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
     // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
     // extending since it makes it easier to re-tag the value in the slow case.
@@ -971,21 +955,25 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 #else
     emitFastArithImmToInt(regT1);
 #endif
-    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
 
-    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // Get the value from the vector
     loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    addSlowCase(branchTestPtr(Zero, regT0));
+
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(JSVALUE64)
     // See comment in op_get_by_val.
@@ -993,23 +981,29 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 #else
     emitFastArithImmToInt(regT1);
 #endif
-    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
 
-    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    Jump inFastVector = branch32(Below, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-    // No; oh well, check if the access if within the vector - if so, we may still be okay.
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
 
-    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
+    Jump empty = branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
-    // All good - put the value into the array.
-    inFastVector.link(this);
-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    Label storeResult(this);
+    emitGetVirtualRegister(value, regT0);
     storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+    Jump end = jump();
+    
+    empty.link(this);
+    add32(Imm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+
+    move(regT1, regT0);
+    add32(Imm32(1), regT0);
+    store32(regT0, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
 }
 
 void JIT::emit_op_put_by_index(Instruction* currentInstruction)
@@ -1357,35 +1351,27 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+
+    move(ImmPtr(&asCell(structure->m_prototype)->m_structure), regT2);
+    move(ImmPtr(asCell(structure->m_prototype)->m_structure), regT3);
+    failureCases.append(branchPtr(NotEqual, Address(regT2), regT3));
+}
+
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     JumpList failureCases;
     // Check eax is an object of the right Structure.
     failureCases.append(emitJumpIfNotJSCell(regT0));
     failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
-    JumpList successCases;
-
-    // ecx = baseObject
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    // proto(ecx) = baseObject->structure()->prototype()
-    failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    testPrototype(oldStructure, failureCases);
 
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-    
     // ecx = baseObject->m_structure
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
-        // null check the prototype
-        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
-
-        // Check the structure id
-        failureCases.append(branchPtr(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(it->get())));
-        
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-    }
-
-    successCases.link(this);
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
 
     Call callTarget;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index cb5354b..c5ed9e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -26,7 +26,7 @@
 #ifndef JITStubCall_h
 #define JITStubCall_h
 
-#include <wtf/Platform.h>
+#include "MacroAssemblerCodeRef.h"
 
 #if ENABLE(JIT)
 
@@ -36,7 +36,7 @@ namespace JSC {
     public:
         JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Cell)
             , m_stackIndex(stackIndexStart)
         {
@@ -44,7 +44,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Cell)
             , m_stackIndex(stackIndexStart)
         {
@@ -52,7 +52,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(VoidPtr)
             , m_stackIndex(stackIndexStart)
         {
@@ -60,7 +60,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Int)
             , m_stackIndex(stackIndexStart)
         {
@@ -68,7 +68,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, bool (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Int)
             , m_stackIndex(stackIndexStart)
         {
@@ -76,7 +76,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, void (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Void)
             , m_stackIndex(stackIndexStart)
         {
@@ -85,7 +85,7 @@ namespace JSC {
 #if USE(JSVALUE32_64)
         JITStubCall(JIT* jit, EncodedJSValue (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Value)
             , m_stackIndex(stackIndexStart)
         {
@@ -171,7 +171,7 @@ namespace JSC {
 
             m_jit->restoreArgumentReference();
             JIT::Call call = m_jit->call();
-            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
+            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub.value()));
 
 #if ENABLE(OPCODE_SAMPLING)
             if (m_jit->m_bytecodeIndex != (unsigned)-1)
@@ -225,7 +225,7 @@ namespace JSC {
         static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
-        void* m_stub;
+        FunctionPtr m_stub;
         enum { Void, VoidPtr, Int, Value, Cell } m_returnType;
         size_t m_stackIndex;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 065b7ea..90ea807 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -75,6 +75,12 @@ namespace JSC {
 #define THUMB_FUNC_PARAM(name)
 #endif
 
+#if PLATFORM(LINUX) && PLATFORM(X86_64)
+#define SYMBOL_STRING_RELOCATION(name) #name "@plt"
+#else
+#define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
+#endif
+
 #if USE(JSVALUE32_64)
 
 #if COMPILER(GCC) && PLATFORM(X86)
@@ -112,7 +118,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addl $0x3c, %esp" "\n"
     "popl %ebx" "\n"
     "popl %edi" "\n"
@@ -175,7 +181,7 @@ asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addq $0x48, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
@@ -239,7 +245,7 @@ asm volatile (
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
@@ -365,7 +371,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addl $0x1c, %esp" "\n"
     "popl %ebx" "\n"
     "popl %edi" "\n"
@@ -434,7 +440,7 @@ asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
@@ -498,7 +504,7 @@ asm volatile (
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
     "ldr r6, [sp, #0x2c]" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
@@ -554,7 +560,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov lr, r6" "\n"
     "add r8, pc, #4" "\n"
     "str r8, [sp, #-4]!" "\n"
-    "b " SYMBOL_STRING(cti_vm_throw) "\n"
+    "b " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
 
 // Both has the same return sequence
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
@@ -694,11 +700,15 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
 
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
-        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
+        if (structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;
         }
+
+        // put_by_id_transition checks the prototype chain for setters.
+        normalizePrototypeChain(callFrame, baseCell);
+
+        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
         stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
         JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress);
         return;
@@ -774,17 +784,13 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
 
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
     }
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-    if (!prototypeChain->isCacheable()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
-        return;
-    }
     stubInfo->initGetByIdChain(structure, prototypeChain);
     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
 }
@@ -1326,15 +1332,11 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
-        StructureChain* protoChain = structure->prototypeChain(callFrame);
-        if (!protoChain->isCacheable()) {
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
-            return JSValue::encode(result);
-        }
-        
+    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+
+        StructureChain* protoChain = structure->prototypeChain(callFrame);
         JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
@@ -1412,7 +1414,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
 
     // ECMA-262 15.3.5.3:
     // Throw an exception either if baseVal is not an object, or if it does not implement 'HasInstance' (i.e. is a function).
-    TypeInfo typeInfo(UnspecifiedType, 0);
+    TypeInfo typeInfo(UnspecifiedType);
     if (!baseVal.isObject() || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance()) {
         CallFrame* callFrame = stackFrame.callFrame;
         CodeBlock* codeBlock = callFrame->codeBlock();
@@ -1942,28 +1944,6 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    int i = stackFrame.args[1].int32();
-    JSValue value = stackFrame.args[2].jsValue();
-
-    ASSERT(isJSArray(stackFrame.globalData, baseValue));
-
-    if (LIKELY(i >= 0))
-        asArray(baseValue)->JSArray::put(callFrame, i, value);
-    else {
-        Identifier property(callFrame, UString::from(i));
-        PutPropertySlot slot;
-        baseValue.put(callFrame, property, value, slot);
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
 DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2672,7 +2652,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
 
     if (!handler) {
         *stackFrame.exception = exceptionValue;
-        STUB_SET_RETURN_ADDRESS(reinterpret_cast<void*>(ctiOpThrowNotCaught));
+        STUB_SET_RETURN_ADDRESS(FunctionPtr(ctiOpThrowNotCaught).value());
         return JSValue::encode(jsNull());
     }
 
@@ -2687,18 +2667,22 @@ DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSPropertyNameIterator::create(stackFrame.callFrame, stackFrame.args[0].jsValue());
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSObject* o = stackFrame.args[0].jsObject();
+    Structure* structure = o->structure();
+    JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+    if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(callFrame))
+        jsPropertyNameIterator = JSPropertyNameIterator::create(callFrame, o);
+    return jsPropertyNameIterator;
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_next_pname)
+DEFINE_STUB_FUNCTION(int, has_property)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSPropertyNameIterator* it = stackFrame.args[0].propertyNameIterator();
-    JSValue temp = it->next(stackFrame.callFrame);
-    if (!temp)
-        it->invalidate();
-    return JSValue::encode(temp);
+    JSObject* base = stackFrame.args[0].jsObject();
+    JSString* property = stackFrame.args[1].jsString();
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -3039,6 +3023,14 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
     return JSValue::encode(exceptionValue);
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, to_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    return JSValue::encode(stackFrame.args[0].jsValue().toObject(callFrame));
+}
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 46973ee..ccbcd2a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -63,6 +63,7 @@ namespace JSC {
         int32_t asInt32;
 
         JSValue jsValue() { return JSValue::decode(asEncodedJSValue); }
+        JSObject* jsObject() { return static_cast<JSObject*>(asPointer); }
         Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
         int32_t int32() { return asInt32; }
         CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
@@ -285,7 +286,6 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
@@ -307,6 +307,7 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_to_object(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
@@ -332,6 +333,7 @@ extern "C" {
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
@@ -345,7 +347,6 @@ extern "C" {
     void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index 9399b1a..b6bc0aa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -29,6 +29,7 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSLock.h"
+#include "JSString.h"
 #include "PrototypeFunction.h"
 #include "SamplingTool.h"
 #include <math.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.pro b/src/3rdparty/webkit/JavaScriptCore/jsc.pro
deleted file mode 100644
index ba880ff..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.pro
+++ /dev/null
@@ -1,31 +0,0 @@
-TEMPLATE = app
-TARGET = jsc
-DESTDIR = .
-SOURCES = jsc.cpp
-QT -= gui
-CONFIG -= app_bundle
-CONFIG += building-libs
-win32-*: CONFIG += console
-win32-msvc*: CONFIG += exceptions_off stl_off
-
-include($$PWD/../WebKit.pri)
-
-CONFIG += link_pkgconfig
-
-QMAKE_RPATHDIR += $$OUTPUT_DIR/lib
-
-isEmpty(OUTPUT_DIR):OUTPUT_DIR=$$PWD/..
-CONFIG(debug, debug|release) {
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    OBJECTS_DIR = obj/release
-}
-OBJECTS_DIR_WTR = $$OBJECTS_DIR$${QMAKE_DIR_SEP}
-include($$PWD/JavaScriptCore.pri)
-
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-}
-
-*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
-*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 85fd163..6d953df 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -27,6 +27,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -48,7 +49,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index 785b219..df30838 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -46,12 +46,6 @@ using namespace JSC;
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
-// A bridge for yacc from the C world to the C++ world.
-int jscyylex(void* lvalp, void* llocp, void* globalData)
-{
-    return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
-}
-
 namespace JSC {
 
 static const UChar byteOrderMark = 0xFEFF;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
index 174e05a..c76696c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
@@ -136,6 +136,12 @@ namespace JSC {
         return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
     }
 
+    // A bridge for yacc from the C world to the C++ world.
+    inline int jscyylex(void* lvalp, void* llocp, void* globalData)
+    {
+        return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
+    }
+
 } // namespace JSC
 
 #endif // Lexer_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 3bd318a..b1e317e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1468,14 +1468,16 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     if (!m_lexpr->isLocation())
         return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
 
-    RefPtr<Label> continueTarget = generator.newLabel(); 
-
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
         generator.emitNode(generator.ignoredResult(), m_init);
-    RegisterID* forInBase = generator.emitNode(m_expr);
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
     generator.emitJump(scope->continueTarget());
 
     RefPtr<Label> loopStart = generator.newLabel();
@@ -1517,7 +1519,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     generator.emitLabel(scope->breakTarget());
     return dst;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
index 2fd4fc1..eef8e93 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
@@ -34,7 +34,7 @@ namespace JSC {
     class ParserArenaDeletable;
     class ParserArenaRefCounted;
 
-    class IdentifierArena {
+    class IdentifierArena : public FastAllocBase {
     public:
         ALWAYS_INLINE const Identifier& makeIdentifier(JSGlobalData*, const UChar* characters, size_t length);
         const Identifier& makeNumericIdentifier(JSGlobalData*, double number);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index 5be84a2..9b674a2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -85,9 +85,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
+
     private:
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
index 0237fd4..fb44494 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -50,7 +50,7 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, NonNullPassRefPtr<Structure>
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
 }
 
-static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
+static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
     // a single numeric argument denotes the array size (!)
     if (args.size() == 1 && args.at(0).isNumber()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 86e3f1b..7a89447 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -149,10 +149,11 @@ static void putProperty(ExecState* exec, JSObject* obj, const Identifier& proper
 
 JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.inherits(&JSArray::info))
+    bool isRealArray = isJSArray(&exec->globalData(), thisValue);
+    if (!isRealArray && !thisValue.inherits(&JSArray::info))
         return throwError(exec, TypeError);
-    JSObject* thisObj = asArray(thisValue);
-
+    JSArray* thisObj = asArray(thisValue);
+    
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
     if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
         if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
@@ -163,34 +164,48 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoiding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned totalSize = length ? length - 1 : 0;
+    Vector<RefPtr<UString::Rep>, 256> strBuffer(length);
     for (unsigned k = 0; k < length; k++) {
-        if (k >= 1)
-            strBuffer.append(',');
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
-        }
-
-        JSValue element = thisObj->get(exec, k);
+        JSValue element;
+        if (isRealArray && thisObj->canGetIndex(k))
+            element = thisObj->getIndex(k);
+        else
+            element = thisObj->get(exec, k);
+        
         if (element.isUndefinedOrNull())
             continue;
-
+        
         UString str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
+        strBuffer[k] = str.rep();
+        totalSize += str.size();
+        
         if (!strBuffer.data()) {
             JSObject* error = Error::create(exec, GeneralError, "Out of memory");
             exec->setException(error);
         }
-
+        
         if (exec->hadException())
             break;
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    if (!totalSize)
+        return jsEmptyString(exec);
+    Vector<UChar> buffer;
+    buffer.reserveCapacity(totalSize);
+    if (!buffer.data())
+        return throwError(exec, GeneralError, "Out of memory");
+        
+    for (unsigned i = 0; i < length; i++) {
+        if (i)
+            buffer.append(',');
+        if (RefPtr<UString::Rep> rep = strBuffer[i])
+            buffer.append(rep->data(), rep->size());
+    }
+    ASSERT(buffer.size() == totalSize);
+    unsigned finalSize = buffer.size();
+    return jsString(exec, UString(buffer.releaseBuffer(), finalSize, false));
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 28f796a..69c2e51 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 01e36c4..f91f36f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -240,9 +240,7 @@ void Heap::destroy()
 template <HeapType heapType>
 NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
-    // Disable the use of vm_map for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if PLATFORM(DARWIN)
     vm_address_t address = 0;
     // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
     vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
@@ -334,9 +332,7 @@ NEVER_INLINE void Heap::freeBlock(size_t block)
 
 NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 {
-    // Disable the use of vm_deallocate for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if PLATFORM(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
 #elif PLATFORM(SYMBIAN)
     userChunk->Free(reinterpret_cast<TAny*>(block));
@@ -1043,16 +1039,6 @@ void Heap::markStackObjectsConservatively(MarkStack& markStack)
 #endif
 }
 
-void Heap::setGCProtectNeedsLocking()
-{
-    // Most clients do not need to call this, with the notable exception of WebCore.
-    // Clients that use shared heap have JSLock protection, while others are supposed
-    // to do explicit locking. WebCore violates this contract in Database code,
-    // which calls gcUnprotect from a secondary thread.
-    if (!m_protectedValuesMutex)
-        m_protectedValuesMutex.set(new Mutex);
-}
-
 void Heap::protect(JSValue k)
 {
     ASSERT(k);
@@ -1061,13 +1047,7 @@ void Heap::protect(JSValue k)
     if (!k.isCell())
         return;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     m_protectedValues.add(k.asCell());
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 void Heap::unprotect(JSValue k)
@@ -1078,28 +1058,16 @@ void Heap::unprotect(JSValue k)
     if (!k.isCell())
         return;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     m_protectedValues.remove(k.asCell());
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 void Heap::markProtectedObjects(MarkStack& markStack)
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it) {
         markStack.append(it->first);
         markStack.drain();
     }
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
 }
 
 template <HeapType heapType> size_t Heap::sweep()
@@ -1291,9 +1259,6 @@ size_t Heap::globalObjectCount()
 
 size_t Heap::protectedGlobalObjectCount()
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     size_t count = 0;
     if (JSGlobalObject* head = m_globalData->head) {
         JSGlobalObject* o = head;
@@ -1304,23 +1269,12 @@ size_t Heap::protectedGlobalObjectCount()
         } while (o != head);
     }
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
     return count;
 }
 
 size_t Heap::protectedObjectCount()
 {
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
-    size_t result = m_protectedValues.size();
-
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
-    return result;
+    return m_protectedValues.size();
 }
 
 static const char* typeName(JSCell* cell)
@@ -1342,16 +1296,10 @@ HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
 {
     HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->lock();
-
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
         counts->add(typeName(it->first));
 
-    if (m_protectedValuesMutex)
-        m_protectedValuesMutex->unlock();
-
     return counts;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index 0ecff19..9ca9d18 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -71,14 +71,6 @@ namespace JSC {
 
         void destroy();
 
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-        // We can inline these functions because everything is compiled as
-        // one file, so the heapAllocate template definitions are available.
-        // However, allocateNumber is used via jsNumberCell outside JavaScriptCore.
-        // Thus allocateNumber needs to provide a non-inline version too.
-        void* inlineAllocateNumber(size_t s) { return heapAllocate<NumberHeap>(s); }
-        void* inlineAllocate(size_t s) { return heapAllocate<PrimaryHeap>(s); }
-#endif
         void* allocateNumber(size_t);
         void* allocate(size_t);
 
@@ -96,7 +88,6 @@ namespace JSC {
         };
         Statistics statistics() const;
 
-        void setGCProtectNeedsLocking();
         void protect(JSValue);
         void unprotect(JSValue);
 
@@ -151,7 +142,6 @@ namespace JSC {
         CollectorHeap primaryHeap;
         CollectorHeap numberHeap;
 
-        OwnPtr<Mutex> m_protectedValuesMutex; // Only non-null if the client explicitly requested it via setGCPrtotectNeedsLocking().
         ProtectCountSet m_protectedValues;
 
         HashSet<MarkedArgumentBuffer*>* m_markListSet;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index 6b479ae..4cd58f5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -22,6 +22,8 @@
 #include "config.h"
 #include "DateInstance.h"
 
+#include "JSGlobalObject.h"
+
 #include <math.h>
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
@@ -45,6 +47,13 @@ DateInstance::DateInstance(NonNullPassRefPtr<Structure> structure)
 {
 }
 
+DateInstance::DateInstance(ExecState* exec, double time)
+    : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
+    , m_cache(0)
+{
+    setInternalValue(jsNumber(exec, timeClip(time)));
+}
+
 DateInstance::~DateInstance()
 {
     delete m_cache;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index c8edc2f..36d90b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -31,6 +31,7 @@ namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
+        DateInstance(ExecState*, double);
         explicit DateInstance(NonNullPassRefPtr<Structure>);
         virtual ~DateInstance();
 
@@ -41,7 +42,7 @@ namespace JSC {
         bool getTime(double& milliseconds, int& offset) const;
         bool getUTCTime(double& milliseconds) const;
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index caed2d4..5fe4f47 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -39,8 +39,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | DateInstance::StructureFlags;
+
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index cc18b95..5bead90 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -66,6 +66,11 @@ JSValue createStackOverflowError(ExecState* exec)
     return createError(exec, RangeError, "Maximum call stack size exceeded.");
 }
 
+JSValue createTypeError(ExecState* exec, const char* message)
+{
+    return createError(exec, TypeError, message);
+}
+
 JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index 4c5bec1..e739d09 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -44,6 +44,7 @@ namespace JSC {
     
     JSValue createInterruptedExecutionException(JSGlobalData*);
     JSValue createStackOverflowError(ExecState*);
+    JSValue createTypeError(ExecState*, const char* message);
     JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
     JSNotAnObjectErrorStub* createNotAnObjectErrorStub(ExecState*, bool isNull);
     JSObject* createInvalidParamError(ExecState*, const char* op, JSValue, unsigned bytecodeOffset, CodeBlock*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index 0e38549..d1d6a1d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags));
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 73dd854..68e9ea3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -50,7 +50,7 @@ namespace JSC {
         void setSetter(JSObject* setter) { m_setter = setter; }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType));
+            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren));
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
index b62ad3e..389b1c3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -37,9 +37,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+    protected:
+        static const unsigned StructureFlags = ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | PrototypeFunction::StructureFlags;
+
     private:
         virtual void markChildren(MarkStack&);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index fdd5cc1..de9a1d6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -42,10 +42,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
     protected:
+        static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
+
         InternalFunction(NonNullPassRefPtr<Structure> structure) : JSObject(structure) { }
         InternalFunction(JSGlobalData*, NonNullPassRefPtr<Structure>, const Identifier&);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 88a8493..aca550e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames));
         }
 
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index 583b988..ee98191 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,10 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
         struct JSActivationData : public JSVariableObjectData {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index c471dac..fd9e7b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -136,9 +136,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
     unsigned initialCapacity = 0;
 
     m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_storage->m_vectorLength = initialCapacity;
-
-    m_fastAccessCutoff = 0;
+    m_vectorLength = initialCapacity;
 
     checkConsistency();
 }
@@ -150,7 +148,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
 
     m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialLength;
-    m_storage->m_vectorLength = initialCapacity;
+    m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = 0;
     m_storage->m_sparseValueMap = 0;
     m_storage->lazyCreationData = 0;
@@ -159,8 +157,6 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
     for (size_t i = 0; i < initialCapacity; ++i)
         vector[i] = JSValue();
 
-    m_fastAccessCutoff = 0;
-
     checkConsistency();
 
     Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
@@ -173,7 +169,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 
     m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialCapacity;
-    m_storage->m_vectorLength = initialCapacity;
+    m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = initialCapacity;
     m_storage->m_sparseValueMap = 0;
 
@@ -182,8 +178,6 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
         m_storage->m_vector[i] = *it;
 
-    m_fastAccessCutoff = initialCapacity;
-
     checkConsistency();
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
@@ -207,7 +201,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
         return false;
     }
 
-    if (i < storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
@@ -253,8 +247,8 @@ bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
     if (isArrayIndex) {
         if (i >= m_storage->m_length)
             return false;
-        if (i < m_storage->m_vectorLength) {
-            JSValue value = m_storage->m_vector[i];
+        if (i < m_vectorLength) {
+            JSValue& value = m_storage->m_vector[i];
             if (value) {
                 descriptor.setDescriptor(value, 0);
                 return true;
@@ -305,7 +299,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
         m_storage->m_length = length;
     }
 
-    if (i < m_storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = m_storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
@@ -313,8 +307,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
             return;
         }
         valueSlot = value;
-        if (++m_storage->m_numValuesInVector == m_storage->m_length)
-            m_fastAccessCutoff = m_storage->m_length;
+        ++m_storage->m_numValuesInVector;
         checkConsistency();
         return;
     }
@@ -352,8 +345,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         if (increaseVectorLength(i + 1)) {
             storage = m_storage;
             storage->m_vector[i] = value;
-            if (++storage->m_numValuesInVector == storage->m_length)
-                m_fastAccessCutoff = storage->m_length;
+            ++storage->m_numValuesInVector;
             checkConsistency();
         } else
             throwOutOfMemoryError(exec);
@@ -363,7 +355,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     // Decide how many values it would be best to move from the map.
     unsigned newNumValuesInVector = storage->m_numValuesInVector + 1;
     unsigned newVectorLength = increasedVectorLength(i + 1);
-    for (unsigned j = max(storage->m_vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
+    for (unsigned j = max(m_vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
         newNumValuesInVector += map->contains(j);
     if (i >= MIN_SPARSE_ARRAY_INDEX)
         newNumValuesInVector -= map->contains(i);
@@ -386,7 +378,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         return;
     }
 
-    unsigned vectorLength = storage->m_vectorLength;
+    unsigned vectorLength = m_vectorLength;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
 
@@ -404,7 +396,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
 
     storage->m_vector[i] = value;
 
-    storage->m_vectorLength = newVectorLength;
+    m_vectorLength = newVectorLength;
     storage->m_numValuesInVector = newNumValuesInVector;
 
     m_storage = storage;
@@ -431,7 +423,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
 
     ArrayStorage* storage = m_storage;
 
-    if (i < storage->m_vectorLength) {
+    if (i < m_vectorLength) {
         JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
@@ -439,8 +431,6 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
         }
         valueSlot = JSValue();
         --storage->m_numValuesInVector;
-        if (m_fastAccessCutoff > i)
-            m_fastAccessCutoff = i;
         checkConsistency();
         return true;
     }
@@ -472,7 +462,7 @@ void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
 
     ArrayStorage* storage = m_storage;
 
-    unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
+    unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
         if (storage->m_vector[i])
             propertyNames.add(Identifier::from(exec, i));
@@ -494,7 +484,7 @@ bool JSArray::increaseVectorLength(unsigned newLength)
 
     ArrayStorage* storage = m_storage;
 
-    unsigned vectorLength = storage->m_vectorLength;
+    unsigned vectorLength = m_vectorLength;
     ASSERT(newLength > vectorLength);
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = increasedVectorLength(newLength);
@@ -503,7 +493,7 @@ bool JSArray::increaseVectorLength(unsigned newLength)
         return false;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
-    storage->m_vectorLength = newVectorLength;
+    m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         storage->m_vector[i] = JSValue();
@@ -521,10 +511,7 @@ void JSArray::setLength(unsigned newLength)
     unsigned length = m_storage->m_length;
 
     if (newLength < length) {
-        if (m_fastAccessCutoff > newLength)
-            m_fastAccessCutoff = newLength;
-
-        unsigned usedVectorLength = min(length, storage->m_vectorLength);
+        unsigned usedVectorLength = min(length, m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
             JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
@@ -563,20 +550,13 @@ JSValue JSArray::pop()
 
     JSValue result;
 
-    if (m_fastAccessCutoff > length) {
-        JSValue& valueSlot = m_storage->m_vector[length];
-        result = valueSlot;
-        ASSERT(result);
-        valueSlot = JSValue();
-        --m_storage->m_numValuesInVector;
-        m_fastAccessCutoff = length;
-    } else if (length < m_storage->m_vectorLength) {
+    if (length < m_vectorLength) {
         JSValue& valueSlot = m_storage->m_vector[length];
-        result = valueSlot;
-        valueSlot = JSValue();
-        if (result)
+        if (valueSlot) {
             --m_storage->m_numValuesInVector;
-        else
+            result = valueSlot;
+            valueSlot = JSValue();
+        } else
             result = jsUndefined();
     } else {
         result = jsUndefined();
@@ -604,11 +584,10 @@ void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
 
-    if (m_storage->m_length < m_storage->m_vectorLength) {
-        ASSERT(!m_storage->m_vector[m_storage->m_length]);
+    if (m_storage->m_length < m_vectorLength) {
         m_storage->m_vector[m_storage->m_length] = value;
-        if (++m_storage->m_numValuesInVector == ++m_storage->m_length)
-            m_fastAccessCutoff = m_storage->m_length;
+        ++m_storage->m_numValuesInVector;
+        ++m_storage->m_length;
         checkConsistency();
         return;
     }
@@ -618,8 +597,8 @@ void JSArray::push(ExecState* exec, JSValue value)
         if (!map || map->isEmpty()) {
             if (increaseVectorLength(m_storage->m_length + 1)) {
                 m_storage->m_vector[m_storage->m_length] = value;
-                if (++m_storage->m_numValuesInVector == ++m_storage->m_length)
-                    m_fastAccessCutoff = m_storage->m_length;
+                ++m_storage->m_numValuesInVector;
+                ++m_storage->m_length;
                 checkConsistency();
                 return;
             }
@@ -837,7 +816,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     if (!m_storage->m_length)
         return;
 
-    unsigned usedVectorLength = min(m_storage->m_length, m_storage->m_vectorLength);
+    unsigned usedVectorLength = min(m_storage->m_length, m_vectorLength);
 
     AVLTree<AVLTreeAbstractorForArrayCompare, 44> tree; // Depth 44 is enough for 2^31 items
     tree.abstractor().m_exec = exec;
@@ -886,7 +865,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
     if (SparseArrayValueMap* map = m_storage->m_sparseValueMap) {
         newUsedVectorLength += map->size();
-        if (newUsedVectorLength > m_storage->m_vectorLength) {
+        if (newUsedVectorLength > m_vectorLength) {
             // Check that it is possible to allocate an array large enough to hold all the entries.
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength)) {
                 throwOutOfMemoryError(exec);
@@ -926,7 +905,6 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
         m_storage->m_vector[i] = JSValue();
 
-    m_fastAccessCutoff = newUsedVectorLength;
     m_storage->m_numValuesInVector = newUsedVectorLength;
 
     checkConsistency(SortConsistencyCheck);
@@ -934,10 +912,16 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
 void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
-    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    JSValue* vector = m_storage->m_vector;
+    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
     unsigned i = 0;
-    for (; i < fastAccessLength; ++i)
-        args.append(getIndex(i));
+    for (; i < vectorEnd; ++i) {
+        JSValue& v = vector[i];
+        if (!v)
+            break;
+        args.append(v);
+    }
+
     for (; i < m_storage->m_length; ++i)
         args.append(get(exec, i));
 }
@@ -946,12 +930,17 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz
 {
     ASSERT(m_storage->m_length == maxSize);
     UNUSED_PARAM(maxSize);
-    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    JSValue* vector = m_storage->m_vector;
+    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
     unsigned i = 0;
-    for (; i < fastAccessLength; ++i)
-        buffer[i] = getIndex(i);
-    uint32_t size = m_storage->m_length;
-    for (; i < size; ++i)
+    for (; i < vectorEnd; ++i) {
+        JSValue& v = vector[i];
+        if (!v)
+            break;
+        buffer[i] = v;
+    }
+
+    for (; i < m_storage->m_length; ++i)
         buffer[i] = get(exec, i);
 }
 
@@ -961,7 +950,7 @@ unsigned JSArray::compactForSorting()
 
     ArrayStorage* storage = m_storage;
 
-    unsigned usedVectorLength = min(m_storage->m_length, storage->m_vectorLength);
+    unsigned usedVectorLength = min(m_storage->m_length, m_vectorLength);
 
     unsigned numDefined = 0;
     unsigned numUndefined = 0;
@@ -985,7 +974,7 @@ unsigned JSArray::compactForSorting()
 
     if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         newUsedVectorLength += map->size();
-        if (newUsedVectorLength > storage->m_vectorLength) {
+        if (newUsedVectorLength > m_vectorLength) {
             // Check that it is possible to allocate an array large enough to hold all the entries - if not,
             // exception is thrown by caller.
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength))
@@ -1006,7 +995,6 @@ unsigned JSArray::compactForSorting()
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
         storage->m_vector[i] = JSValue();
 
-    m_fastAccessCutoff = newUsedVectorLength;
     storage->m_numValuesInVector = newUsedVectorLength;
 
     checkConsistency(SortConsistencyCheck);
@@ -1032,30 +1020,27 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
     if (type == SortConsistencyCheck)
         ASSERT(!m_storage->m_sparseValueMap);
 
-    ASSERT(m_fastAccessCutoff <= m_storage->m_length);
-    ASSERT(m_fastAccessCutoff <= m_storage->m_numValuesInVector);
-
     unsigned numValuesInVector = 0;
-    for (unsigned i = 0; i < m_storage->m_vectorLength; ++i) {
+    for (unsigned i = 0; i < m_vectorLength; ++i) {
         if (JSValue value = m_storage->m_vector[i]) {
             ASSERT(i < m_storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value->type(); // Likely to crash if the object was deallocated.
             ++numValuesInVector;
         } else {
-            ASSERT(i >= m_fastAccessCutoff);
             if (type == SortConsistencyCheck)
                 ASSERT(i >= m_storage->m_numValuesInVector);
         }
     }
     ASSERT(numValuesInVector == m_storage->m_numValuesInVector);
+    ASSERT(numValuesInVector <= m_storage->m_length);
 
     if (m_storage->m_sparseValueMap) {
         SparseArrayValueMap::iterator end = m_storage->m_sparseValueMap->end();
         for (SparseArrayValueMap::iterator it = m_storage->m_sparseValueMap->begin(); it != end; ++it) {
             unsigned index = it->first;
             ASSERT(index < m_storage->m_length);
-            ASSERT(index >= m_storage->m_vectorLength);
+            ASSERT(index >= m_vectorLength);
             ASSERT(index <= MAX_ARRAY_INDEX);
             ASSERT(it->second);
             if (type != DestructorConsistencyCheck)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 12768a4..8c22451 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -29,7 +29,6 @@ namespace JSC {
 
     struct ArrayStorage {
         unsigned m_length;
-        unsigned m_vectorLength;
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
         void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
@@ -63,18 +62,24 @@ namespace JSC {
         void push(ExecState*, JSValue);
         JSValue pop();
 
-        bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
+        bool canGetIndex(unsigned i) { return i < m_vectorLength && m_storage->m_vector[i]; }
         JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
             return m_storage->m_vector[i];
         }
 
-        bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValue setIndex(unsigned i, JSValue v)
+        bool canSetIndex(unsigned i) { return i < m_vectorLength; }
+        void setIndex(unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
-            return m_storage->m_vector[i] = v;
+            JSValue& x = m_storage->m_vector[i];
+            if (!x) {
+                ++m_storage->m_numValuesInVector;
+                if (i >= m_storage->m_length)
+                    m_storage->m_length = i + 1;
+            }
+            x = v;
         }
 
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
@@ -82,12 +87,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
 
     protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
@@ -110,7 +116,7 @@ namespace JSC {
         enum ConsistencyCheckType { NormalConsistencyCheck, DestructorConsistencyCheck, SortConsistencyCheck };
         void checkConsistency(ConsistencyCheckType = NormalConsistencyCheck);
 
-        unsigned m_fastAccessCutoff;
+        unsigned m_vectorLength;
         ArrayStorage* m_storage;
     };
 
@@ -139,7 +145,7 @@ namespace JSC {
         
         ArrayStorage* storage = m_storage;
 
-        unsigned usedVectorLength = std::min(storage->m_length, storage->m_vectorLength);
+        unsigned usedVectorLength = std::min(storage->m_length, m_vectorLength);
         markStack.appendValues(storage->m_vector, usedVectorLength, MayContainNullValues);
 
         if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
@@ -152,7 +158,7 @@ namespace JSC {
     inline void MarkStack::markChildren(JSCell* cell)
     {
         ASSERT(Heap::isCellMarked(cell));
-        if (cell->structure()->typeInfo().hasDefaultMark()) {
+        if (!cell->structure()->typeInfo().overridesMarkChildren()) {
 #ifdef NDEBUG
             asObject(cell)->markChildrenDirect(*this);
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 90d39f0..5e5003b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -45,7 +45,7 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
     
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index 006f4a2..fe6e124 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -91,6 +91,9 @@ namespace JSC {
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
+
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSByteArray(VPtrStealingHackType) 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index aa93252..fae056e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -78,11 +78,7 @@ extern const double Inf = NaNInf.doubles.Inf_Double;
 
 void* JSCell::operator new(size_t size, ExecState* exec)
 {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-    return exec->heap()->inlineAllocate(size);
-#else
     return exec->heap()->allocate(size);
-#endif
 }
 
 bool JSCell::getUInt32(uint32_t&) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 503c6c4..16a5131 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -112,14 +112,6 @@ namespace JSC {
         Structure* m_structure;
     };
 
-    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
-    JSCell* asCell(JSValue);
-
-    inline JSCell* asCell(JSValue value)
-    {
-        return value.asCell();
-    }
-
     inline JSCell::JSCell(Structure* structure)
         : m_structure(structure)
     {
@@ -162,11 +154,7 @@ namespace JSC {
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
     {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-        return globalData->heap.inlineAllocate(size);
-#else
         return globalData->heap.allocate(size);
-#endif
     }
 
     // --- JSValue inlines ----------------------------
@@ -342,11 +330,6 @@ namespace JSC {
             append(value.asCell());
     }
 
-    inline void Structure::markAggregate(MarkStack& markStack)
-    {
-        markStack.append(m_prototype);
-    }
-
     inline Heap* Heap::heap(JSValue v)
     {
         if (!v.isCell())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index a9ac63e..b4356c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -61,7 +61,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
         NativeFunction nativeFunction()
@@ -72,6 +72,9 @@ namespace JSC {
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
+    protected:
+        const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | InternalFunction::StructureFlags;
+
     private:
         JSFunction(NonNullPassRefPtr<Structure>);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index 3bb281e..cf3f1d1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -89,7 +89,7 @@ static inline void markIfNeeded(MarkStack& markStack, JSValue v)
 static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
 {
     if (s)
-        s->markAggregate(markStack);
+        markIfNeeded(markStack, s->storedPrototype());
 }
 
 JSGlobalObject::~JSGlobalObject()
@@ -394,6 +394,21 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     markIfNeeded(markStack, d()->methodCallDummy);
 
     markIfNeeded(markStack, d()->errorStructure);
+    markIfNeeded(markStack, d()->argumentsStructure);
+    markIfNeeded(markStack, d()->arrayStructure);
+    markIfNeeded(markStack, d()->booleanObjectStructure);
+    markIfNeeded(markStack, d()->callbackConstructorStructure);
+    markIfNeeded(markStack, d()->callbackFunctionStructure);
+    markIfNeeded(markStack, d()->callbackObjectStructure);
+    markIfNeeded(markStack, d()->dateStructure);
+    markIfNeeded(markStack, d()->emptyObjectStructure);
+    markIfNeeded(markStack, d()->errorStructure);
+    markIfNeeded(markStack, d()->functionStructure);
+    markIfNeeded(markStack, d()->numberObjectStructure);
+    markIfNeeded(markStack, d()->prototypeFunctionStructure);
+    markIfNeeded(markStack, d()->regExpMatchesArrayStructure);
+    markIfNeeded(markStack, d()->regExpStructure);
+    markIfNeeded(markStack, d()->stringObjectStructure);
 
     // No need to mark the other structures, because their prototypes are all
     // guaranteed to be referenced elsewhere.
@@ -448,11 +463,7 @@ void JSGlobalObject::copyGlobalsTo(RegisterFile& registerFile)
 
 void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
 {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-    return globalData->heap.inlineAllocate(size);
-#else
     return globalData->heap.allocate(size);
-#endif
 }
 
 void JSGlobalObject::destroyJSGlobalObjectData(void* jsGlobalObjectData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 2106783..720d3a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -267,10 +267,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
+
         struct GlobalPropertyInfo {
             GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
                 : identifier(i)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index 0d9aca6..a271c4e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -62,10 +62,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
      private:
+        
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
+
         // JSValue methods
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 6a48081..309488f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -68,23 +68,15 @@ namespace JSC {
 
         void* operator new(size_t size, ExecState* exec)
         {
-    #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-            return exec->heap()->inlineAllocateNumber(size);
-    #else
             return exec->heap()->allocateNumber(size);
-    #endif
         }
 
         void* operator new(size_t size, JSGlobalData* globalData)
         {
-    #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-            return globalData->heap.inlineAllocateNumber(size);
-    #else
             return globalData->heap.allocateNumber(size);
-    #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion | HasDefaultMark)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
index 65c9803..ec3fa40 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -41,11 +41,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+
     private:
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index db2a9b2..6932ded 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -42,6 +42,25 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
+static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+{
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->propHashTable(exec);
+        if (!table)
+            continue;
+        table->initializeIfNeeded(exec);
+        ASSERT(table->table);
+
+        int hashSizeMask = table->compactSize - 1;
+        const HashEntry* entry = table->table;
+        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
+            if (entry->key() && !(entry->attributes() & DontEnum))
+                propertyNames.add(entry->key());
+        }
+    }
+}
+
 void JSObject::markChildren(MarkStack& markStack)
 {
 #ifndef NDEBUG
@@ -424,12 +443,29 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
 
 void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
+    getOwnPropertyNames(exec, propertyNames);
+
+    if (prototype().isNull())
+        return;
+
+    JSObject* prototype = asObject(this->prototype());
+    while(1) {
+        if (prototype->structure()->typeInfo().overridesGetPropertyNames()) {
+            prototype->getPropertyNames(exec, propertyNames);
+            break;
+        }
+        prototype->getOwnPropertyNames(exec, propertyNames);
+        JSValue nextProto = prototype->prototype();
+        if (nextProto.isNull())
+            break;
+        prototype = asObject(nextProto);
+    }
 }
 
 void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getOwnEnumerablePropertyNames(exec, propertyNames, this);
+    m_structure->getEnumerablePropertyNames(propertyNames);
+    getEnumerablePropertyNames(exec, classInfo(), propertyNames);
 }
 
 bool JSObject::toBoolean(ExecState*) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 84b5f4b..1dbab94 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -207,10 +207,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = 0;
+
         void addAnonymousSlots(unsigned count);
         void putAnonymousValue(unsigned index, JSValue value)
         {
@@ -368,7 +370,7 @@ ALWAYS_INLINE bool JSObject::getOwnPropertySlot(ExecState* exec, const Identifie
 
 ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (structure()->typeInfo().hasStandardGetOwnPropertySlot())
+    if (!structure()->typeInfo().overridesGetOwnPropertySlot())
         return asObject(this)->inlineGetOwnPropertySlot(exec, propertyName, slot);
     return getOwnPropertySlot(exec, propertyName, slot);
 }
@@ -682,7 +684,7 @@ ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
 
-    m_structure->markAggregate(markStack);
+    markStack.append(prototype());
     
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index e08a3d9..2cd9f75 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -29,26 +29,56 @@
 #include "config.h"
 #include "JSPropertyNameIterator.h"
 
+#include "JSGlobalObject.h"
+
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
-JSPropertyNameIterator::~JSPropertyNameIterator()
+JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
+    ASSERT(!o->structure()->enumerationCache() ||
+            o->structure()->enumerationCache()->cachedStructure() != o->structure() ||
+            o->structure()->enumerationCache()->cachedPrototypeChain() != o->structure()->prototypeChain(exec));
+
+    PropertyNameArray propertyNames(exec);
+    o->getPropertyNames(exec, propertyNames);
+    JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data());
+
+    if (o->structure()->isDictionary())
+        return jsPropertyNameIterator;
+
+    if (o->structure()->typeInfo().overridesGetPropertyNames())
+        return jsPropertyNameIterator;
+    
+    size_t count = normalizePrototypeChain(exec, o);
+    StructureChain* structureChain = o->structure()->prototypeChain(exec);
+    RefPtr<Structure>* structure = structureChain->head();
+    for (size_t i = 0; i < count; ++i) {
+        if (structure[i]->typeInfo().overridesGetPropertyNames())
+            return jsPropertyNameIterator;
+    }
+
+    jsPropertyNameIterator->setCachedPrototypeChain(structureChain);
+    jsPropertyNameIterator->setCachedStructure(o->structure());
+    o->structure()->setEnumerationCache(jsPropertyNameIterator);
+    return jsPropertyNameIterator;
 }
 
-void JSPropertyNameIterator::markChildren(MarkStack& markStack)
+JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
-    JSCell::markChildren(markStack);
-    if (m_object)
-        markStack.append(m_object);
+    JSValue& identifier = m_jsStrings[i];
+    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
+        return identifier;
+
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+        return JSValue();
+    return identifier;
 }
 
-void JSPropertyNameIterator::invalidate()
+void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
-    ASSERT(m_position == m_end);
-    m_object = 0;
-    m_data.clear();
+    markStack.appendValues(m_jsStrings.get(), m_jsStringsSize, MayContainNullValues);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index d2849a8..0559e0b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -31,6 +31,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Operations.h"
 #include "PropertyNameArray.h"
 
 namespace JSC {
@@ -39,73 +40,51 @@ namespace JSC {
     class JSObject;
 
     class JSPropertyNameIterator : public JSCell {
-    public:
-        static JSPropertyNameIterator* create(ExecState*, JSValue);
-
-        virtual ~JSPropertyNameIterator();
-
-        virtual void markChildren(MarkStack&);
+        friend class JIT;
 
-        JSValue next(ExecState*);
-        void invalidate();
+    public:
+        static JSPropertyNameIterator* create(ExecState*, JSObject*);
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
         }
+
+        virtual void markChildren(MarkStack&);
+
+        JSValue get(ExecState*, JSObject*, size_t i);
+        size_t size() { return m_jsStringsSize; }
+
+        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
+        Structure* cachedStructure() { return m_cachedStructure; }
+
+        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
+        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
+
     private:
-        JSPropertyNameIterator(ExecState*);
-        JSPropertyNameIterator(ExecState*, JSObject*, PassRefPtr<PropertyNameArrayData> propertyNameArrayData);
+        JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData);
 
-        JSObject* m_object;
-        RefPtr<PropertyNameArrayData> m_data;
-        PropertyNameArrayData::const_iterator m_position;
-        PropertyNameArrayData::const_iterator m_end;
+        Structure* m_cachedStructure;
+        RefPtr<StructureChain> m_cachedPrototypeChain;
+        size_t m_jsStringsSize;
+        OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec)
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData)
     : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_object(0)
-    , m_position(0)
-    , m_end(0)
+    , m_cachedStructure(0)
+    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
+    , m_jsStrings(new JSValue[m_jsStringsSize])
 {
+    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
+    for (size_t i = 0; i < m_jsStringsSize; ++i)
+        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
 }
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, JSObject* object, PassRefPtr<PropertyNameArrayData> propertyNameArrayData)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_object(object)
-    , m_data(propertyNameArrayData)
-    , m_position(m_data->begin())
-    , m_end(m_data->end())
-{
-}
-
-inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
+inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
 {
-    if (v.isUndefinedOrNull())
-        return new (exec) JSPropertyNameIterator(exec);
-
-    JSObject* o = v.toObject(exec);
-    PropertyNameArray propertyNames(exec);
-    o->getPropertyNames(exec, propertyNames);
-    return new (exec) JSPropertyNameIterator(exec, o, propertyNames.releaseData());
-}
-
-inline JSValue JSPropertyNameIterator::next(ExecState* exec)
-{
-    if (m_position == m_end)
-        return JSValue();
-
-    if (m_data->cachedStructure() == m_object->structure() && m_data->cachedPrototypeChain() == m_object->structure()->prototypeChain(exec))
-        return jsOwnedString(exec, (*m_position++).ustring());
-
-    do {
-        if (m_object->hasProperty(exec, *m_position))
-            return jsOwnedString(exec, (*m_position++).ustring());
-        m_position++;
-    } while (m_position != m_end);
-
-    return JSValue();
+    ASSERT(!isDictionary());
+    m_enumerationCache = enumerationCache;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index 5eb0e4b..2542878 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -57,7 +57,10 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
         JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index 91ddaeb..20ba868 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -139,45 +139,4 @@ bool JSString::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Proper
     return JSString::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSString* jsString(JSGlobalData* globalData, const UString& s)
-{
-    int size = s.size();
-    if (!size)
-        return globalData->smallStrings.emptyString(globalData);
-    if (size == 1) {
-        UChar c = s.data()[0];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, s);
-}
-    
-JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
-{
-    ASSERT(offset <= static_cast<unsigned>(s.size()));
-    ASSERT(length <= static_cast<unsigned>(s.size()));
-    ASSERT(offset + length <= static_cast<unsigned>(s.size()));
-    if (!length)
-        return globalData->smallStrings.emptyString(globalData);
-    if (length == 1) {
-        UChar c = s.data()[offset];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
-}
-
-JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
-{
-    int size = s.size();
-    if (!size)
-        return globalData->smallStrings.emptyString(globalData);
-    if (size == 1) {
-        UChar c = s.data()[0];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index 1e46551..39dfe75 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -92,7 +92,7 @@ namespace JSC {
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion | HasDefaultMark)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -169,6 +169,47 @@ namespace JSC {
         return jsSingleCharacterSubstring(globalData, m_value, i);
     }
 
+    inline JSString* jsString(JSGlobalData* globalData, const UString& s)
+    {
+        int size = s.size();
+        if (!size)
+            return globalData->smallStrings.emptyString(globalData);
+        if (size == 1) {
+            UChar c = s.data()[0];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, s);
+    }
+        
+    inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
+    {
+        ASSERT(offset <= static_cast<unsigned>(s.size()));
+        ASSERT(length <= static_cast<unsigned>(s.size()));
+        ASSERT(offset + length <= static_cast<unsigned>(s.size()));
+        if (!length)
+            return globalData->smallStrings.emptyString(globalData);
+        if (length == 1) {
+            UChar c = s.data()[offset];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+    }
+
+    inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
+    {
+        int size = s.size();
+        if (!size)
+            return globalData->smallStrings.emptyString(globalData);
+        if (size == 1) {
+            UChar c = s.data()[0];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
+    }
+
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
     inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
index 279510b..7c89600 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
@@ -40,9 +40,9 @@ namespace JSC {
     static const unsigned OverridesHasInstance = 1 << 2;
     static const unsigned ImplementsDefaultHasInstance = 1 << 3;
     static const unsigned NeedsThisConversion = 1 << 4;
-    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
-    static const unsigned HasDefaultMark = 1 << 6;
-    static const unsigned HasDefaultGetPropertyNames = 1 << 7;
+    static const unsigned OverridesGetOwnPropertySlot = 1 << 5;
+    static const unsigned OverridesMarkChildren = 1 << 6;
+    static const unsigned OverridesGetPropertyNames = 1 << 7;
 
     class TypeInfo {
         friend class JIT;
@@ -63,9 +63,9 @@ namespace JSC {
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
         bool overridesHasInstance() const { return m_flags & OverridesHasInstance; }
         bool needsThisConversion() const { return m_flags & NeedsThisConversion; }
-        bool hasStandardGetOwnPropertySlot() const { return m_flags & HasStandardGetOwnPropertySlot; }
-        bool hasDefaultMark() const { return m_flags & HasDefaultMark; }
-        bool hasDefaultGetPropertyNames() const { return m_flags & HasDefaultGetPropertyNames; }
+        bool overridesGetOwnPropertySlot() const { return m_flags & OverridesGetOwnPropertySlot; }
+        bool overridesMarkChildren() const { return m_flags & OverridesMarkChildren; }
+        bool overridesGetPropertyNames() const { return m_flags & OverridesGetPropertyNames; }
         unsigned flags() const { return m_flags; }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index 39a4093..699c1cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -110,7 +110,10 @@ char* JSValue::description()
 {
     static const size_t size = 32;
     static char description[size];
-    if (isInt32())
+
+    if (!*this)
+        snprintf(description, size, "<JSValue()>");
+    else if (isInt32())
         snprintf(description, size, "Int32: %d", asInt32());
     else if (isDouble())
         snprintf(description, size, "Double: %lf", asDouble());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index 58e74b1..1063cdc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -213,7 +213,8 @@ namespace JSC {
         enum { FalseTag =        0xfffffffc };
         enum { NullTag =         0xfffffffb };
         enum { UndefinedTag =    0xfffffffa };
-        enum { DeletedValueTag = 0xfffffff9 };
+        enum { EmptyValueTag =   0xfffffff9 };
+        enum { DeletedValueTag = 0xfffffff8 };
 
         enum { LowestTag =  DeletedValueTag };
 
@@ -372,6 +373,14 @@ namespace JSC {
         return static_cast<uint32_t>(val);
     }
 
+    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
+    JSCell* asCell(JSValue);
+
+    inline JSCell* asCell(JSValue value)
+    {
+        return value.asCell();
+    }
+
     ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
     {
         if (isInt32())
@@ -427,7 +436,7 @@ namespace JSC {
 
     inline JSValue::JSValue()
     {
-        u.asBits.tag = CellTag;
+        u.asBits.tag = EmptyValueTag;
         u.asBits.payload = 0;
     }
 
@@ -463,19 +472,26 @@ namespace JSC {
 
     inline JSValue::JSValue(JSCell* ptr)
     {
-        u.asBits.tag = CellTag;
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
     {
-        u.asBits.tag = CellTag;
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
     }
 
     inline JSValue::operator bool() const
     {
-        return u.asBits.payload || tag() != CellTag;
+        ASSERT(tag() != DeletedValueTag);
+        return tag() != EmptyValueTag;
     }
 
     inline bool JSValue::operator==(const JSValue& other) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index 66e78c3..d8b1479 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -60,10 +60,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
         
     protected:
+        static const unsigned StructureFlags = OverridesGetPropertyNames | JSObject::StructureFlags;
         // Subclasses of JSVariableObject can subclass this struct to add data
         // without increasing their own size (since there's a hard limit on the
         // size of a JSCell).
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 723b75d..191ff3b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -38,7 +38,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
index ba00057e0..ea09f54 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -47,7 +47,7 @@ namespace JSC {
         }
 
         ALWAYS_INLINE void append(JSValue);
-        ALWAYS_INLINE void append(JSCell*);
+        void append(JSCell*);
         
         ALWAYS_INLINE void appendValues(Register* values, size_t count, MarkSetProperties properties = NoNullValues)
         {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index fee5ec5..7f474b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -37,8 +37,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index 908c55f..cf19b6f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -39,11 +39,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | InternalFunction::StructureFlags;
+
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index ca3923d..8223a90 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -30,17 +30,19 @@ namespace JSC {
         explicit NumberObject(NonNullPassRefPtr<Structure>);
 
         static const ClassInfo info;
-#if USE(JSVALUE32)
+
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+#if USE(JSVALUE32)
+        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 #else
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
-        {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
-        }
+        static const unsigned StructureFlags = JSWrapperObject::StructureFlags;
 #endif
+
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index a456423..837d5a6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -125,6 +125,7 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
     return description;
 }
 
+// FIXME: Use the enumeration cache.
 JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (!args.at(0).isObject())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index 5da9e38..1aa68b3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -224,15 +224,15 @@ namespace JSC {
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValue baseValue, const PropertySlot& slot)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
     {
-        JSCell* cell = asCell(baseValue);
+        JSCell* cell = asCell(base);
         size_t count = 0;
 
-        while (slot.slotBase() != cell) {
+        while (slotBase != cell) {
             JSValue v = cell->structure()->prototypeForLookup(callFrame);
 
-            // If we didn't find slotBase in baseValue's prototype chain, then baseValue
+            // If we didn't find slotBase in base's prototype chain, then base
             // must be a proxy for another object.
 
             if (v.isNull())
@@ -252,6 +252,25 @@ namespace JSC {
         return count;
     }
 
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSCell* base)
+    {
+        size_t count = 0;
+        while (1) {
+            JSValue v = base->structure()->prototypeForLookup(callFrame);
+            if (v.isNull())
+                return count;
+
+            base = asCell(v);
+
+            // Since we're accessing a prototype in a loop, it's a good bet that it
+            // should not be treated as a dictionary.
+            if (base->structure()->isDictionary())
+                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+
+            ++count;
+        }
+    }
+
     ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
     {
         ScopeChainIterator iter = scopeChain->begin();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index 0878e73..c28b6a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -21,6 +21,9 @@
 #include "config.h"
 #include "PropertyNameArray.h"
 
+#include "Structure.h"
+#include "StructureChain.h"
+
 namespace JSC {
 
 static const size_t setThreshold = 20;
@@ -44,7 +47,7 @@ void PropertyNameArray::add(UString::Rep* identifier)
             return;
     }
 
-    m_data->propertyNameVector().append(Identifier(m_globalData, identifier));
+    addKnownUnique(identifier);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
index afcc83f..3dbcc9d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
@@ -23,45 +23,35 @@
 
 #include "CallFrame.h"
 #include "Identifier.h"
-#include "Structure.h"
 #include <wtf/HashSet.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
+    
+    class Structure;
+    class StructureChain;
 
+    // FIXME: Rename to PropertyNameArray.
     class PropertyNameArrayData : public RefCounted<PropertyNameArrayData> {
     public:
         typedef Vector<Identifier, 20> PropertyNameVector;
-        typedef PropertyNameVector::const_iterator const_iterator;
 
         static PassRefPtr<PropertyNameArrayData> create() { return adoptRef(new PropertyNameArrayData); }
 
-        const_iterator begin() const { return m_propertyNameVector.begin(); }
-        const_iterator end() const { return m_propertyNameVector.end(); }
-
         PropertyNameVector& propertyNameVector() { return m_propertyNameVector; }
 
-        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
-        Structure* cachedStructure() const { return m_cachedStructure; }
-
-        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
-        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
-
     private:
         PropertyNameArrayData()
-            : m_cachedStructure(0)
         {
         }
 
         PropertyNameVector m_propertyNameVector;
-        Structure* m_cachedStructure;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
     };
 
+    // FIXME: Rename to PropertyNameArrayBuilder.
     class PropertyNameArray {
     public:
-        typedef PropertyNameArrayData::const_iterator const_iterator;
-
         PropertyNameArray(JSGlobalData* globalData)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(globalData)
@@ -82,21 +72,18 @@ namespace JSC {
         void add(UString::Rep*);
         void addKnownUnique(UString::Rep* identifier) { m_data->propertyNameVector().append(Identifier(m_globalData, identifier)); }
 
-        size_t size() const { return m_data->propertyNameVector().size(); }
-
         Identifier& operator[](unsigned i) { return m_data->propertyNameVector()[i]; }
         const Identifier& operator[](unsigned i) const { return m_data->propertyNameVector()[i]; }
 
-        const_iterator begin() const { return m_data->begin(); }
-        const_iterator end() const { return m_data->end(); }
-
         void setData(PassRefPtr<PropertyNameArrayData> data) { m_data = data; }
         PropertyNameArrayData* data() { return m_data.get(); }
-
         PassRefPtr<PropertyNameArrayData> releaseData() { return m_data.release(); }
 
-        void setShouldCache(bool shouldCache) { m_shouldCache = shouldCache; }
-        bool shouldCache() const { return m_shouldCache; }
+        // FIXME: Remove these functions.
+        typedef PropertyNameArrayData::PropertyNameVector::const_iterator const_iterator;
+        size_t size() const { return m_data->propertyNameVector().size(); }
+        const_iterator begin() const { return m_data->propertyNameVector().begin(); }
+        const_iterator end() const { return m_data->propertyNameVector().end(); }
 
     private:
         typedef HashSet<UString::Rep*, PtrHash<UString::Rep*> > IdentifierSet;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
index 224164d..a0d5443 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
@@ -22,8 +22,8 @@
 #ifndef Protect_h
 #define Protect_h
 
-#include "JSCell.h"
 #include "Collector.h"
+#include "JSValue.h"
 
 namespace JSC {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index dbf2d44..c609e08 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -90,28 +90,6 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-struct RegExpConstructorPrivate : FastAllocBase {
-    // Global search cache / settings
-    RegExpConstructorPrivate()
-        : lastNumSubPatterns(0)
-        , multiline(false)
-        , lastOvectorIndex(0)
-    {
-    }
-
-    const Vector<int, 32>& lastOvector() const { return ovector[lastOvectorIndex]; }
-    Vector<int, 32>& lastOvector() { return ovector[lastOvectorIndex]; }
-    Vector<int, 32>& tempOvector() { return ovector[lastOvectorIndex ? 0 : 1]; }
-    void changeLastOvector() { lastOvectorIndex = lastOvectorIndex ? 0 : 1; }
-
-    UString input;
-    UString lastInput;
-    Vector<int, 32> ovector[2];
-    unsigned lastNumSubPatterns : 30;
-    bool multiline : 1;
-    unsigned lastOvectorIndex : 1;
-};
-
 RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, "RegExp"))
     , d(new RegExpConstructorPrivate)
@@ -123,30 +101,6 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structur
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly | DontDelete | DontEnum);
 }
 
-/* 
-  To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
-  expression matching through the performMatch function. We use cached results to calculate, 
-  e.g., RegExp.lastMatch and RegExp.leftParen.
-*/
-void RegExpConstructor::performMatch(RegExp* r, const UString& s, int startOffset, int& position, int& length, int** ovector)
-{
-    position = r->match(s, startOffset, &d->tempOvector());
-
-    if (ovector)
-        *ovector = d->tempOvector().data();
-
-    if (position != -1) {
-        ASSERT(!d->tempOvector().isEmpty());
-
-        length = d->tempOvector()[1] - d->tempOvector()[0];
-
-        d->input = s;
-        d->lastInput = s;
-        d->changeLastOvector();
-        d->lastNumSubPatterns = r->numSubpatterns();
-    }
-}
-
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
     : JSArray(exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f8bccf4..f9ca9cf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -22,6 +22,7 @@
 #define RegExpConstructor_h
 
 #include "InternalFunction.h"
+#include "RegExp.h"
 #include <wtf/OwnPtr.h>
 
 namespace JSC {
@@ -30,13 +31,35 @@ namespace JSC {
     class RegExpPrototype;
     struct RegExpConstructorPrivate;
 
+    struct RegExpConstructorPrivate : FastAllocBase {
+        // Global search cache / settings
+        RegExpConstructorPrivate()
+            : lastNumSubPatterns(0)
+            , multiline(false)
+            , lastOvectorIndex(0)
+        {
+        }
+
+        const Vector<int, 32>& lastOvector() const { return ovector[lastOvectorIndex]; }
+        Vector<int, 32>& lastOvector() { return ovector[lastOvectorIndex]; }
+        Vector<int, 32>& tempOvector() { return ovector[lastOvectorIndex ? 0 : 1]; }
+        void changeLastOvector() { lastOvectorIndex = lastOvectorIndex ? 0 : 1; }
+
+        UString input;
+        UString lastInput;
+        Vector<int, 32> ovector[2];
+        unsigned lastNumSubPatterns : 30;
+        bool multiline : 1;
+        unsigned lastOvectorIndex : 1;
+    };
+
     class RegExpConstructor : public InternalFunction {
     public:
         RegExpConstructor(ExecState*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -59,6 +82,9 @@ namespace JSC {
         JSValue getLeftContext(ExecState*) const;
         JSValue getRightContext(ExecState*) const;
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | InternalFunction::StructureFlags;
+
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
@@ -78,6 +104,30 @@ namespace JSC {
         return static_cast<RegExpConstructor*>(asObject(value));
     }
 
+    /* 
+      To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
+      expression matching through the performMatch function. We use cached results to calculate, 
+      e.g., RegExp.lastMatch and RegExp.leftParen.
+    */
+    inline void RegExpConstructor::performMatch(RegExp* r, const UString& s, int startOffset, int& position, int& length, int** ovector)
+    {
+        position = r->match(s, startOffset, &d->tempOvector());
+
+        if (ovector)
+            *ovector = d->tempOvector().data();
+
+        if (position != -1) {
+            ASSERT(!d->tempOvector().isEmpty());
+
+            length = d->tempOvector()[1] - d->tempOvector()[0];
+
+            d->input = s;
+            d->lastInput = s;
+            d->changeLastOvector();
+            d->lastNumSubPatterns = r->numSubpatterns();
+        }
+    }
+
 } // namespace JSC
 
 #endif // RegExpConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 877d7b6..679d072 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -159,7 +159,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
     }
 
     int position;
-    int length;
+    int length = 0;
     regExpConstructor->performMatch(d->regExp.get(), input, static_cast<int>(d->lastIndex), position, length);
     if (position < 0) {
         d->lastIndex = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index f5a9340..3117c86 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -49,9 +49,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+
     private:
         bool match(ExecState*, const ArgList&);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 944f6ba..84e1ad2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -48,10 +48,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
         StringObject(NonNullPassRefPtr<Structure>, JSString*);
   };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 0cba83d..69e1939 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,9 +44,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined | HasDefaultMark)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
+
         virtual bool toBoolean(ExecState*) const { return false; }
     };
  
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index b57732a..a0713b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -25,6 +25,7 @@
 #include "CachedCall.h"
 #include "Error.h"
 #include "Executable.h"
+#include "JSGlobalObjectFunctions.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -72,6 +73,10 @@ static JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*, JSObject*, JSVa
 static JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*, JSObject*, JSValue, const ArgList&);
 
+static JSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState*, JSObject*, JSValue, const ArgList&);
+
 }
 
 #include "StringPrototype.lut.h"
@@ -117,6 +122,9 @@ const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, Exec
     fontsize              stringProtoFuncFontsize          DontEnum|Function       1
     anchor                stringProtoFuncAnchor            DontEnum|Function       1
     link                  stringProtoFuncLink              DontEnum|Function       1
+    trim                  stringProtoFuncTrim              DontEnum|Function       0
+    trimLeft              stringProtoFuncTrimLeft          DontEnum|Function       0
+    trimRight             stringProtoFuncTrimRight         DontEnum|Function       0
 @end
 */
 
@@ -249,7 +257,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 return jsNull();
             while (true) {
                 int matchIndex;
-                int matchLen;
+                int matchLen = 0;
                 int* ovector;
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
@@ -290,7 +298,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         } else {
             do {
                 int matchIndex;
-                int matchLen;
+                int matchLen = 0;
                 int* ovector;
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
@@ -485,7 +493,7 @@ JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue t
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
-    int matchLength;
+    int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
     if (!(reg->global())) {
         // case without 'g' flag is handled like RegExp.prototype.exec
@@ -535,7 +543,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
-    int matchLength;
+    int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
     return jsNumber(exec, pos);
 }
@@ -899,4 +907,51 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     return jsNontrivialString(exec, UString(buffer, bufferSize, false));
 }
 
+enum {
+    TrimLeft = 1,
+    TrimRight = 2
+};
+
+static inline bool isTrimWhitespace(UChar c)
+{
+    return isStrWhiteSpace(c) || c == 0x200b;
+}
+
+static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
+{
+    UString str = thisValue.toThisString(exec);
+    int left = 0;
+    if (trimKind & TrimLeft) {
+        while (left < str.size() && isTrimWhitespace(str[left]))
+            left++;
+    }
+    int right = str.size();
+    if (trimKind & TrimRight) {
+        while (right > left && isTrimWhitespace(str[right - 1]))
+            right--;
+    }
+
+    // Don't gc allocate a new string if we don't have to.
+    if (left == 0 && right == str.size() && thisValue.isString())
+        return thisValue;
+
+    return jsString(exec, str.substr(left, right - left));
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimLeft | TrimRight);
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimLeft);
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimRight);
+}
+    
+    
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 7209b5f..a11050f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -28,9 +28,10 @@
 
 #include "Identifier.h"
 #include "JSObject.h"
+#include "JSPropertyNameIterator.h"
+#include "Lookup.h"
 #include "PropertyNameArray.h"
 #include "StructureChain.h"
-#include "Lookup.h"
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/RefPtr.h>
 
@@ -159,9 +160,9 @@ Structure::~Structure()
             m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
 
     }
-
-    if (m_cachedPropertyNameArrayData)
-        m_cachedPropertyNameArrayData->setCachedStructure(0);
+    
+    if (m_enumerationCache)
+        m_enumerationCache->setCachedStructure(0);
 
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
@@ -282,59 +283,6 @@ void Structure::materializePropertyMap()
     }
 }
 
-void Structure::getOwnEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
-{
-    getEnumerableNamesFromPropertyTable(propertyNames);
-    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
-}
-
-void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
-{
-    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || isDictionary());
-
-    if (shouldCache && m_cachedPropertyNameArrayData) {
-        if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
-            propertyNames.setData(m_cachedPropertyNameArrayData);
-            return;
-        }
-        clearEnumerationCache();
-    }
-
-    baseObject->getOwnPropertyNames(exec, propertyNames);
-
-    if (m_prototype.isObject()) {
-        propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
-        JSObject* prototype = asObject(m_prototype);
-        while(1) {
-            if (!prototype->structure()->typeInfo().hasDefaultGetPropertyNames()) {
-                prototype->getPropertyNames(exec, propertyNames);
-                break;
-            }
-            prototype->getOwnPropertyNames(exec, propertyNames);
-            JSValue nextProto = prototype->prototype();
-            if (!nextProto.isObject())
-                break;
-            prototype = asObject(nextProto);
-        }
-    }
-
-    if (shouldCache) {
-        StructureChain* protoChain = prototypeChain(exec);
-        m_cachedPropertyNameArrayData = propertyNames.data();
-        if (!protoChain->isCacheable())
-            return;
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(protoChain);
-        m_cachedPropertyNameArrayData->setCachedStructure(this);
-    }
-}
-
-void Structure::clearEnumerationCache()
-{
-    if (m_cachedPropertyNameArrayData)
-        m_cachedPropertyNameArrayData->setCachedStructure(0);
-    m_cachedPropertyNameArrayData.clear();
-}
-
 void Structure::growPropertyStorageCapacity()
 {
     if (m_propertyStorageCapacity == JSObject::inlineStorageCapacity)
@@ -598,25 +546,25 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
+    ASSERT(!m_enumerationCache);
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
     size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
-    clearEnumerationCache();
     return offset;
 }
 
 size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
 {
     ASSERT(isUncacheableDictionary());
+    ASSERT(!m_enumerationCache);
 
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
-    clearEnumerationCache();
     return offset;
 }
 
@@ -1057,7 +1005,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
+void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1114,25 +1062,6 @@ void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyN
     }
 }
 
-void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
-{
-    // Add properties from the static hashtables of properties
-    for (; classInfo; classInfo = classInfo->parentClass) {
-        const HashTable* table = classInfo->propHashTable(exec);
-        if (!table)
-            continue;
-        table->initializeIfNeeded(exec);
-        ASSERT(table->table);
-
-        int hashSizeMask = table->compactSize - 1;
-        const HashEntry* entry = table->table;
-        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
-                propertyNames.add(entry->key());
-        }
-    }
-}
-
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
 void Structure::checkConsistency()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index ed9f6e5..2496c1b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -30,6 +30,8 @@
 #include "JSType.h"
 #include "JSValue.h"
 #include "PropertyMapHashTable.h"
+#include "PropertyNameArray.h"
+#include "Protect.h"
 #include "StructureChain.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
@@ -76,8 +78,6 @@ namespace JSC {
 
         ~Structure();
 
-        void markAggregate(MarkStack&);
-
         // These should be used with caution.  
         size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
@@ -116,9 +116,6 @@ namespace JSC {
             return hasTransition(propertyName._ustring.rep(), attributes);
         }
 
-        void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
-        void getOwnEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
-
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
 
@@ -127,6 +124,10 @@ namespace JSC {
         JSCell* specificValue() { return m_specificValueInPrevious; }
         void despecifyDictionaryFunction(const Identifier& propertyName);
 
+        void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        JSPropertyNameIterator* enumerationCache() { return m_enumerationCache.get(); }
+        void getEnumerablePropertyNames(PropertyNameArray&);
+
     private:
         Structure(JSValue prototype, const TypeInfo&);
         
@@ -140,8 +141,6 @@ namespace JSC {
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
         void addAnonymousSlots(unsigned slotCount);
-        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
-        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -162,8 +161,6 @@ namespace JSC {
             materializePropertyMap();
         }
 
-        void clearEnumerationCache();
-
         signed char transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
@@ -189,7 +186,7 @@ namespace JSC {
 
         StructureTransitionTable table;
 
-        RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
+        ProtectedPtr<JSPropertyNameIterator> m_enumerationCache;
 
         PropertyMapHashTable* m_propertyTable;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
index 6e8a0ee..085876c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
@@ -46,18 +46,4 @@ StructureChain::StructureChain(Structure* head)
     m_vector[i] = 0;
 }
 
-bool StructureChain::isCacheable() const
-{
-    uint32_t i = 0;
-    
-    while (m_vector[i]) {
-        // Both classes of dictionary structure may change arbitrarily so we can't cache them
-        if (m_vector[i]->isDictionary())
-            return false;
-        if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
-            return false;
-    }
-    return true;
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
index c48749d..816b66d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
@@ -36,10 +36,11 @@ namespace JSC {
     class Structure;
 
     class StructureChain : public RefCounted<StructureChain> {
+        friend class JIT;
+
     public:
         static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
-        bool isCacheable() const;
 
     private:
         StructureChain(Structure* head);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wscript b/src/3rdparty/webkit/JavaScriptCore/wscript
index 9dd37c9..7a5ba1b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wscript
+++ b/src/3rdparty/webkit/JavaScriptCore/wscript
@@ -30,7 +30,7 @@ import commands
 from settings import *
 
 jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
-jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp']))
+jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
 
 sources = []
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 6a05211..f682f0d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -70,10 +70,6 @@ namespace WTF {
             return !m_refCounter.hasOneRef() || (m_threadSafeRefCounter && !m_threadSafeRefCounter->hasOneRef());
         }
 
-#ifndef NDEBUG
-        bool mayBePassedToAnotherThread() const { ASSERT(!m_threadId); return m_refCounter.hasOneRef(); }
-#endif
-
     private:
         CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
             : m_threadSafeRefCounter(threadedCounter)
@@ -92,6 +88,10 @@ namespace WTF {
 
         void threadSafeDeref();
 
+#ifndef NDEBUG
+        bool isOwnedByCurrentThread() const { return !m_threadId || m_threadId == currentThread(); }
+#endif
+
         RefCountedBase m_refCounter;
         ThreadSafeSharedBase* m_threadSafeRefCounter;
         T* m_data;
@@ -103,7 +103,7 @@ namespace WTF {
     template<class T>
     void CrossThreadRefCounted<T>::ref()
     {
-        ASSERT(!m_threadId || m_threadId == currentThread());
+        ASSERT(isOwnedByCurrentThread());
         m_refCounter.ref();
 #ifndef NDEBUG
         // Store the threadId as soon as the ref count gets to 2.
@@ -119,7 +119,7 @@ namespace WTF {
     template<class T>
     void CrossThreadRefCounted<T>::deref()
     {
-        ASSERT(!m_threadId || m_threadId == currentThread());
+        ASSERT(isOwnedByCurrentThread());
         if (m_refCounter.derefBase()) {
             threadSafeDeref();
             delete this;
@@ -146,10 +146,12 @@ namespace WTF {
     template<class T>
     PassRefPtr<CrossThreadRefCounted<T> > CrossThreadRefCounted<T>::crossThreadCopy()
     {
+        ASSERT(isOwnedByCurrentThread());
         if (m_threadSafeRefCounter)
             m_threadSafeRefCounter->ref();
         else
             m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+
         return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index a9472c9..6cd8ef0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -379,6 +379,9 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
+#if PLATFORM(UNIX)
+#include <unistd.h>
+#endif
 #if COMPILER(MSVC)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
@@ -391,6 +394,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #if PLATFORM(DARWIN)
 #include "MallocZoneSupport.h"
 #include <wtf/HashSet.h>
+#include <wtf/Vector.h>
 #endif
 
 #ifndef PRIuS
@@ -2274,7 +2278,7 @@ static inline TCMalloc_PageHeap* getPageHeap()
 #define pageheap getPageHeap()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-#if PLATFORM(WIN)
+#if PLATFORM(WIN_OS)
 static void sleep(unsigned seconds)
 {
     ::Sleep(seconds * 1000);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index b23e7b0..ca0961c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -213,6 +213,9 @@ using WTF::fastMallocAllow;
 // debug-only code to make sure we don't use the system malloc via the default operator
 // new by accident.
 
+// We musn't customize the global operator new and delete for the Qt port.
+#if !PLATFORM(QT)
+
 WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
@@ -224,4 +227,6 @@ WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw(
 
 #endif
 
+#endif
+
 #endif /* WTF_FastMalloc_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
index d863226..8bf6447 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ListRefPtr.h
@@ -44,6 +44,9 @@ namespace WTF {
         template <typename U> ListRefPtr& operator=(const PassRefPtr<U>& o) { RefPtr<T>::operator=(o); return *this; }
     };
 
+    // Remove inline for winscw compiler to prevent the compiler agressively resolving
+    // T::ref() in RefPtr<T>'s copy constructor.  The bug is reported at:
+    // https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
     template <typename T> 
 #if !COMPILER(WINSCW)
     inline
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
index 324300d..556230e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
@@ -102,6 +102,8 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
+inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
+inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
 inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
 inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
 inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 9fbfa85..7151b514 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -231,40 +231,94 @@
 #if   defined(arm) \
    || defined(__arm__)
 #define WTF_PLATFORM_ARM 1
+
 #if defined(__ARMEB__)
 #define WTF_PLATFORM_BIG_ENDIAN 1
-#elif !defined(__ARM_EABI__) && !defined(__EABI__) && !defined(__VFP_FP__)
+
+#elif !defined(__ARM_EABI__) \
+   && !defined(__EABI__) \
+   && !defined(__VFP_FP__)
 #define WTF_PLATFORM_MIDDLE_ENDIAN 1
+
 #endif
-#define ARM_ARCH_VERSION 3
-#if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__) || defined(__MARM_ARMV4__) \
-    || defined(_ARMV4I_)
-#undef ARM_ARCH_VERSION
+
+/* Set ARM_ARCH_VERSION */
+#if   defined(__ARM_ARCH_4__) \
+   || defined(__ARM_ARCH_4T__) \
+   || defined(__MARM_ARMV4__) \
+   || defined(_ARMV4I_)
 #define ARM_ARCH_VERSION 4
-#endif
-#if defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__) \
-        || defined(__ARM_ARCH_5E__) || defined(__ARM_ARCH_5TE__) \
-        || defined(__ARM_ARCH_5TEJ__) || defined(__MARM_ARMV5__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_5__) \
+   || defined(__ARM_ARCH_5T__) \
+   || defined(__ARM_ARCH_5E__) \
+   || defined(__ARM_ARCH_5TE__) \
+   || defined(__ARM_ARCH_5TEJ__) \
+   || defined(__MARM_ARMV5__)
 #define ARM_ARCH_VERSION 5
-#endif
-#if defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) \
-     || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) \
-     || defined(__ARM_ARCH_6ZK__) || defined(__ARMV6__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_6__) \
+   || defined(__ARM_ARCH_6J__) \
+   || defined(__ARM_ARCH_6K__) \
+   || defined(__ARM_ARCH_6Z__) \
+   || defined(__ARM_ARCH_6ZK__) \
+   || defined(__ARM_ARCH_6T2__) \
+   || defined(__ARMV6__)
 #define ARM_ARCH_VERSION 6
-#endif
-#if defined(__ARM_ARCH_7A__)
-#undef ARM_ARCH_VERSION
+
+#elif defined(__ARM_ARCH_7A__) \
+   || defined(__ARM_ARCH_7R__)
 #define ARM_ARCH_VERSION 7
+
+/* RVCT sets _TARGET_ARCH_ARM */
+#elif defined(__TARGET_ARCH_ARM)
+#define ARM_ARCH_VERSION __TARGET_ARCH_ARM
+
+#else
+#define ARM_ARCH_VERSION 0
+
 #endif
+
+/* Set THUMB_ARM_VERSION */
+#if   defined(__ARM_ARCH_4T__)
+#define THUMB_ARCH_VERSION 1
+
+#elif defined(__ARM_ARCH_5T__) \
+   || defined(__ARM_ARCH_5TE__) \
+   || defined(__ARM_ARCH_5TEJ__)
+#define THUMB_ARCH_VERSION 2
+
+#elif defined(__ARM_ARCH_6J__) \
+   || defined(__ARM_ARCH_6K__) \
+   || defined(__ARM_ARCH_6Z__) \
+   || defined(__ARM_ARCH_6ZK__) \
+   || defined(__ARM_ARCH_6M__)
+#define THUMB_ARCH_VERSION 3
+
+#elif defined(__ARM_ARCH_6T2__) \
+   || defined(__ARM_ARCH_7__) \
+   || defined(__ARM_ARCH_7A__) \
+   || defined(__ARM_ARCH_7R__) \
+   || defined(__ARM_ARCH_7M__)
+#define THUMB_ARCH_VERSION 4
+
+/* RVCT sets __TARGET_ARCH_THUMB */
+#elif defined(__TARGET_ARCH_THUMB)
+#define THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
+
+#else
+#define THUMB_ARCH_VERSION 0
+#endif
+
 /* On ARMv5 and below the natural alignment is required. */
 #if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
 #define ARM_REQUIRE_NATURAL_ALIGNMENT 1
 #endif
+
 /* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
 #if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
-#  if defined(thumb2) || defined(__thumb2__)
+#  if defined(thumb2) || defined(__thumb2__) \
+  || ((defined(__thumb) || defined(__thumb__)) && THUMB_ARCH_VERSION == 4)
 #    define WTF_PLATFORM_ARM_TRADITIONAL 0
 #    define WTF_PLATFORM_ARM_THUMB2 1
 #  elif PLATFORM_ARM_ARCH(4)
@@ -805,6 +859,10 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WARN_UNUSED_RETURN
 #endif
 
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((PLATFORM(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
+#define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
+#endif
+
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index 0e6e208..52fb130 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -82,6 +82,23 @@ double randomNumber()
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #elif PLATFORM(WINCE)
     return genrand_res53();
+#elif PLATFORM(WIN_OS)
+    uint32_t part1 = rand() & (RAND_MAX - 1);
+    uint32_t part2 = rand() & (RAND_MAX - 1);
+    uint32_t part3 = rand() & (RAND_MAX - 1);
+    uint32_t part4 = rand() & (RAND_MAX - 1);
+    // rand only provides 15 bits on Win32
+    uint64_t fullRandom = part1;
+    fullRandom <<= 15;
+    fullRandom |= part2;
+    fullRandom <<= 15;
+    fullRandom |= part3;
+    fullRandom <<= 15;
+    fullRandom |= part4;
+
+    // Mask off the low 53bits
+    fullRandom &= (1LL << 53) - 1;
+    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #else
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 559e3f2..1120d65 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -75,12 +75,12 @@ inline char* strdup(const char* strSource)
 
 inline int strncasecmp(const char* s1, const char* s2, size_t len)
 {
-    return strnicmp(s1, s2, len);
+    return _strnicmp(s1, s2, len);
 }
 
 inline int strcasecmp(const char* s1, const char* s2)
 {
-    return stricmp(s1, s2);
+    return _stricmp(s1, s2);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index d777424..b635a45 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -1400,14 +1400,6 @@ void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const
     }
 }
 
-int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
-{
-    if (JSRegExp* fallback = jitObject.getFallback())
-        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
-
-    return jitObject.execute(input, start, length, output);
-}
-
 }}
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
index 5b0df9d..1872f21 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -82,7 +82,14 @@ private:
 };
 
 void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
-int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize);
+
+inline int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
+{
+    if (JSRegExp* fallback = jitObject.getFallback())
+        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
+
+    return jitObject.execute(input, start, length, output);
+}
 
 } } // namespace JSC::Yarr
 
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7f50b5c..488c6a0 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        qtwebkit-4.6-snapshot-30092009-2 branch/tag
+        qtwebkit-4.6-snapshot-22102009 branch/tag
 
 and has the sha1 checksum
 
-        284ebfc0df42d408d99838507c1ed335fba9bcf0
+        0639bb8e812c8923287cd5523248ca64fa5f7a50
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 493a64d..4e5dff8 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,4124 @@
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Set EnabledAtRuntime for WebSocket in DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        Supported by chromium/v8 only.
+        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
+        bindings.
+        Remove Settings::experimentalWebSocketsEnabled() and
+        setExperimentalWebSocketsEnabled(bool).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::setIsAvailable):
+        (WebCore::WebSocket::isAvailable):
+        * websockets/WebSocket.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Whoops, make prototype bindings actually use the StructureFlags.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-10-19  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Better implementation of WebCore::ScriptString for the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29909
+
+        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
+        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
+        is pretty inefficient, especially since responseText is built up with a sequence of
+        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
+        this patch adopts a similar approach for V8.
+
+        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::v8StringOrNull):
+        * bindings/v8/ScriptStringImpl.cpp: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::~ScriptStringImpl):
+        (WebCore::ScriptStringImpl::toString):
+        (WebCore::ScriptStringImpl::isNull):
+        (WebCore::ScriptStringImpl::size):
+        (WebCore::ScriptStringImpl::append):
+        * bindings/v8/ScriptStringImpl.h: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r49837.
+        http://trac.webkit.org/changeset/49837
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        * page/Settings.h:
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        * platform/text/UScriptCode.h: Removed.
+
+2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
+        https://bugs.webkit.org/show_bug.cgi?id=30473
+
+        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
+        PLALTFORM(WIN_OS) guards.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-10-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20797
+
+        Make generic font family getters/setters accept an additional
+        argument (script code). It has a default value so that if an embedder
+        does not have/want a per-script font family setting, call-sites
+        don't have to be changed.
+        This is to prepare for fixing bug 10874 (font selection is not
+        language-dependent) and bug 18085.
+
+        There should be no change in layout and no new layout test
+        is added.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/text/UScriptCode.h: Added. This is for ports that
+          do not use ICU. the part of ICU's common/unicode/uscript.h
+          that defines script code enum was copied. To keep enums compatible
+          with those in ICU, we don't generate the list out of Scripts.txt
+          of the Unicode Data base or CLDR's data.
+
+2009-10-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clarify usage of SuddenTermination API. No code change.
+
+        * platform/SuddenTermination.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Make DOM bindings automatically inherit correct structure
+        flags rather than being needlessly conservative.  This is
+        done by making the bindings generator use the same model
+        for TypeInfo flags that we now use in JSC.
+
+        This gains us about 1% of this regression back.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fixed a bug on nested SVG <use> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=26117
+        When a <use> element refer to another <use> element which has
+        child/children, the instance tree built for this <use> element
+        is incorrect (more nodes than expected).
+
+        Test: svg/dom/use-on-use-with-child.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Small changes to fully invalidate and update the JavaScriptCallFrame.
+
+        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=27146
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::invalidate):
+        (WebCore::JavaScriptCallFrame::update):
+
+2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Remove "source" from storage events
+        https://bugs.webkit.org/show_bug.cgi?id=30536
+
+        Remove "source" from storage events per
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        This was removed because it makes it introduces synchronous access that can
+        cross the event loop boundry (since a storage event can fire from one process
+        and be handled in another).
+
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::uri):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ResourceLoadNotifier::activeDocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30533
+
+        Removing this method from ResourceLoadNotifier better decouples the
+        notifier from FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::requestFromDelegate):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move sendRemainingDelegateMessages to ResourceLoadNotifier
+        https://bugs.webkit.org/show_bug.cgi?id=30531
+
+        This method is about notifying folks and doesn't interact with the rest
+        of FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bypass popup blocker using click event
+        https://bugs.webkit.org/show_bug.cgi?id=21501
+
+        Keep track of which events were generated by JavaScript and use that
+        inforation when figuring out if we're processing a user gesture.
+
+        Test: http/tests/security/popup-blocked-from-fake-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::createdByDOM):
+        (WebCore::Event::setCreatedByDOM):
+
+2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixing a typo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30543
+
+        * platform/sql/SQLiteDatabase.h:
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30544
+
+        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+
+2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Flash at end of opacity/transform transition sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=30501
+        
+        When a transition finishes, there window of time between when the animation is
+        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
+        to its old appearance for one or two frames. To avoid this, we set the final
+        transform or opacity at the start of the transition; we know that the animation
+        will override the final value for as long as its running.
+        
+        No test because this is a very transient effect that can't be captured
+        in a test.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateLayerOpacity):
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+
+2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add more stop characters into console completions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30477
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Adam Roben.
+
+        implemented ClipboardWin::files()
+        https://bugs.webkit.org/show_bug.cgi?id=29666
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28986
+
+        Tests: http/tests/navigation/no-referrer-reset.html
+               http/tests/navigation/no-referrer-same-window.html
+               http/tests/navigation/no-referrer-subframe.html
+               http/tests/navigation/no-referrer-target-blank.html
+
+        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
+        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::hasRel):
+        (WebCore::HTMLAnchorElement::setRel):
+        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
+        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
+        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
+        * loader/FrameLoaderTypes.h: Add enum for referrer policy
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
+
+
+2009-10-19  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
+
+        [v8] typeof(HTMLMediaElement) should return undefined if media
+        engine is not available
+        https://bugs.webkit.org/show_bug.cgi?id=30343
+
+        Check for availability of the media engine to disable
+        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
+        in runtime.
+
+        Try runs and review in Chromium:
+        http://codereview.chromium.org/276011
+
+        Test: manual-tests/chromium/media-player-not-available.html
+
+        The above test can work work in Chromium. Testing procedures:
+        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
+        2. Open Chromium with above test page
+        3. Verify the test results according to the test page
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Declare enabler methods.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Report enabled only if media player is available.
+        * manual-tests/chromium/media-player-not-available.html: Added.
+        Manual test, following instruction in this test for procedures.
+        * page/DOMWindow.idl:
+        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
+        as enabled at runtime.
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Refactor out some of the code in paint() into paintPanScrollIcon()
+        and paintScrollbars() in preparation of some Qt API changes.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make the local static panScrollIcon into a Image* instead
+        of a RefPtr<Image>.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Forcefully set antialiasing for Chromium media controls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30521
+
+        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+
+2009-10-19  Jens Alfke  <jens@mooseyard.com>
+
+        Reviewed by Darin Adler.
+
+        Optimize string upper/lowercasing
+        https://bugs.webkit.org/show_bug.cgi?id=30261
+        
+        - Added AtomicString::upper() and lower()
+        - Further optimized StringImpl::lower()
+        - Removed StringImpl::isLower()
+        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
+          thousands of upper() calls and string allocations.
+ 
+         * dom/Element.cpp:
+         (WebCore::Element::setAttribute): Call AtomicString::lower()
+         * dom/QualifiedName.cpp:
+         (WebCore::QualifiedName::localNameUpper): New method
+         * dom/QualifiedName.h: Added localNameUpper() method
+         * dom/StyledElement.cpp:
+         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
+         * html/HTMLDocument.cpp:
+         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
+         * html/HTMLElement.cpp:
+         (WebCore::HTMLElement::nodeName): Call localNameUpper()
+         * platform/text/AtomicString.cpp:
+         (WebCore::AtomicString::lower): New method
+         (WebCore::AtomicString::upper): New method
+         * platform/text/AtomicString.h: Added lower() and upper()
+         * platform/text/StringImpl.cpp: Removed isLower()
+         (WebCore::StringImpl::lower): Further optimization of initial loop
+         * platform/text/StringImpl.h: Removed isLower()
+ 
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If a call to a plugin's invokeMethod, invokeDefault or construct
+        returns false, throw an exception into JS.        
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        Test: plugins/netscape-invoke-failure.html
+
+        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
+        (npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod): Check return value
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
+        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+
+2009-10-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for chromium/skia canvas arc start/end positions, when the arc is
+        >= 360 degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=30449
+
+        Covered by new test:
+        LayoutTests/fast/canvas/arc360.html
+
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::addArc):
+
+2009-10-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix uninitialized variable reference in Element::removeAttribute().
+        https://bugs.webkit.org/show_bug.cgi?id=30502
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+
+2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30463
+        Remove HTML5 media element 'loadend' event
+
+        * dom/EventNames.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::noneSupported): Ditto.
+        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove deletion of outgoing FormData object when reply is finished.
+        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
+        fastRealloc edge case.
+        https://bugs.webkit.org/show_bug.cgi?id=29313
+
+        No test, the crash shows up occasionally in crash dumps, we weren't able
+        to reproduce it locally.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
+            avoid calling fastRealloc with the size of 0.
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30371
+
+        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
+2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed build warning fix.
+        [Qt] Apply changes to WebCore.pro introduced in r49778
+
+        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+
+2009-10-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move feGaussianBlur from WebCore/svg to WebCore/platform
+        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+
+        This patch moves SVGFRGaussianBlur from svg/graphics/filters
+        to platform/graphics/filters/FEGaussianBlur. This is needed
+        for shadow support on Qt and Cairo.
+        No change in functionality, therfore no new test case needed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
+        * platform/graphics/filters/FEGaussianBlur.h: Added.
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
+        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
+
+2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Added reviewer name to r49574.
+
+2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30489
+        [Gtk] The document frame/html container claims to be parentless
+
+        Work around for the parentless claim made by the accessible associated
+        with the embedded WebView. When we identify this condition, get the
+        widget's parent, and then get the AtkObject from that. Admittedly an ugly
+        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
+        plan to switch over to WebKit.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-19  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Handle duration queries properly
+        https://bugs.webkit.org/show_bug.cgi?id=29999
+
+        Previously duration queries failed to handle unknown duration
+        and didn't treat the returned duration as an unsigned.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix build on Windows.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::~PluginContainerQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+        Allow one to customize the minimal and maximal shrink factors used when printing.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPrintingMinimumShrinkFactor):
+        (WebCore::Settings::setPrintingMaximumShrinkFactor):
+        * page/Settings.h:
+        (WebCore::Settings::printingMinimumShrinkFactor):
+        (WebCore::Settings::printingMaximumShrinkFactor):
+
+2009-10-18  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes issue where doubleclicking a word could select following adjacent newlines.
+        https://bugs.webkit.org/show_bug.cgi?id=30234
+
+        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/mac/editing/selection/script-tests/TEMPLATE.html
+               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/win/editing/selection/script-tests/TEMPLATE.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix, use proper header name.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30485
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._printArray):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touching WebCore so that it
+        initiated inspector frontend deployment on Windows.
+
+        Web Inspector: frontend files are not deployed in Windows
+        incremental build.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Title of dir(["test", "test2"]) should be Array
+
+        https://bugs.webkit.org/show_bug.cgi?id=30486
+
+        Test: inspector/console-tests.html
+
+        * inspector/front-end/InjectedScript.js:
+
+2009-10-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
+        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+
+        Patch for SVGMaskElement landed in r49598 should correct the location of
+        the mask image graphics context. It only corrects the location for userSpaceOnUse
+        mode in maskContentUnits but breaks objectBoundingBoxMode.
+        The maskDestRect shouldn't be moved. It is not responsible for the correct context
+        postioin but for the correct position of the mask image.
+        This patch calculates the context postion independently from the maskDestRect.
+        It also uses lineareRGB color space for masking on CG now. This is the default
+        color space for masking operations.
+        We already have tests for both maskContentUnits modes.
+
+            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
+            *svg/custom/mask-with-default-value.svg
+
+        Some tests needed new pixel tests because of the new color space.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-18  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
+        That is notably faster for small numbers (most common case).
+        https://bugs.webkit.org/show_bug.cgi?id=30493
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add MathML sources if MathML support is enabled.
+
+        * GNUmakefile.am:
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-PCH build fix. Added missing header.
+
+        * bridge/runtime_root.h:
+
+2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layers not correctly updated after partial layout
+        https://bugs.webkit.org/show_bug.cgi?id=30425
+        
+        When a partial layout happened, for example as the result of a postion-change-only
+        layout, then some compositing layer positions were not correctly updated. To fix
+        this, updateLayerPositions() now carries along a flag that is set at the rootmost
+        layer being updated, and used to determine when we hit the first compositing layer
+        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
+        to do a full geometry update on that layer, which is thus the rootmost compositing
+        layer that is being updated.
+
+        Test: compositing/geometry/partial-layout-update.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for proxies in CURL.
+ 
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * platform/network/curl/ResourceHandleManager.h:
+        (WebCore::ResourceHandleManager::):
+
+2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez
+
+        https://bugs.webkit.org/show_bug.cgi?id=25901
+        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+
+        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Cleanup SVGElement code, preparing for animVal support
+        https://bugs.webkit.org/show_bug.cgi?id=30466
+
+        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
+        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
+        be used to control the start/end state of an animated property.
+
+        We're currently tracking animated properties that need synchronization, generalize this concept and use
+        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
+        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+
+        No change in functionality, thus no tests.
+
+        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
+        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
+        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
+        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
+        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
+        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::viewTarget):
+        * svg/SVGViewSpec.h: Ditto.
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Added.
+        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h: Added.
+        (WebCore::SynchronizableProperty::SynchronizableProperty):
+        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
+        (WebCore::SynchronizableProperty::operator==):
+        (WebCore::SynchronizablePropertyHash::hash):
+        (WebCore::SynchronizablePropertyHash::equal):
+        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
+        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
+
+2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25413
+        [GTK] Please expose the level of headings
+
+        Exposes the heading level as an attribute of the AtkObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (addAttributeToSet):
+        (webkit_accessible_get_attributes):
+        (webkit_accessible_class_init):
+
+2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=30472
+
+        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
+        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+
+        * page/EventHandler.cpp:
+
+2009-10-17  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Video controls not zoomed / transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=30461
+
+        Draw the images in the controls scaled.
+
+        No new tests. With this change Chromium will pass the following tests:
+        LayoutTests/media/video-controls-zoomed.html
+        LayoutTests/media/video-controls-transformed.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        Pass along the target rect directly.
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        Adjust the thumb slide applied with the scale factor.
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Gtk] Build fix for WebKitGtk after r49723.
+
+        Add bindings/js/JSExceptionBase.* to the build.
+
+        * GNUmakefile.am:
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49723.
+
+        Add bindings/js/JSExceptionBase.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
+        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_hasBeenHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::hasBeenHalted):
+        Return m_hasBeenHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_hasBeenHalted.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        @charset rule after the first byte causes the rest of css to be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=18265
+
+        Apparently we're supposed to tolerate whitespace before the charset
+        rule so folks can write code like this:
+
+        <style>
+        @charset "utf-8"
+        ...
+        </style>
+
+        I'm told this is one of the top compatability problems in China.
+        Tests: fast/css/comment-before-charset-external.html
+               fast/css/comment-before-charset.html
+               fast/css/many-spaces-before-charset.html
+               fast/css/space-before-charset-external.html
+               fast/css/space-before-charset.html
+
+        * css/CSSGrammar.y:
+
+2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes part of <http://webkit.org/b/30412>.
+        Web Inspector should get human readable DOM Exceptions.
+
+        Add a description field to ExceptionBase, and call it through 
+        reportException which allows the user/developer to get a more detailed
+        and coherent error explanation through the Web Inspector.
+
+        This only applies to exceptions that come from a script on the page when
+        it is run. DOM Exceptions that come from the code run in the console, or DOM
+        exceptions that are caught and logged will come in a future patch.
+
+        Tests: inspector/uncaught-dom1-exception.html
+               inspector/uncaught-dom3-exception.html
+               inspector/uncaught-dom8-exception.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        * bindings/js/JSExceptionBase.cpp: Added.
+        (WebCore::toExceptionBase):
+        * bindings/js/JSExceptionBase.h: Added.
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::):
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: forgot to check in this #include.
+
+        * bridge/runtime_root.h:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transform layer gets stuck with the wrong transform after an animation ends
+        <rdar://problem/7311662>
+
+        Work around a CoreAnimation bug which causes an animated transform layer to
+        end up with a stale transform.
+        
+        Test: compositing/animation/state-at-end-event-transform-layer.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::bug7311367Workaround):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After running a transition with an end event listener, can't change the transform
+        https://bugs.webkit.org/show_bug.cgi?id=30454
+        
+        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
+        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        
+        Now, we always clean up the animations right after queuing up the end events.
+
+        Tests: animations/state-at-end-event.html
+               transitions/move-after-transition.html
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=30428
+
+        TextNode => Edit Text Node
+        Has Attributes => Edit First Attribute
+        No Attributes => Start Editing New Attribute
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
+        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
+        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix header indent style for FrameLoader and friends
+        https://bugs.webkit.org/show_bug.cgi?id=30430
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::frame):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::notifier):
+        (WebCore::FrameLoader::isLoadingMainResource):
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state):
+        (WebCore::FrameLoader::client):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+        (WebCore::FrameLoader::committingFirstRealLoad):
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * loader/HistoryController.h:
+        (WebCore::HistoryController::currentItem):
+        (WebCore::HistoryController::provisionalItem):
+        * loader/PolicyCallback.h:
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyChecker.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        * loader/RedirectScheduler.h:
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
+        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49693, because it broke Chromium build.
+        http://trac.webkit.org/changeset/49693
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+
+        Noticable changes:
+            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
+            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+
+        Tests: media/video-src-empty.html
+               media/video-src-none.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=30407
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Insecure plug-ins don't trigger mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=30431
+
+        Added the missing check.
+
+        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Set autobuffer to true and schedule load in V8 audio element constructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30448
+
+        Covered by existing tests.
+
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30422
+
+        Covered by existing media layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Removed round() and FIXME.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30410
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-16  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Transform transitions that used to be accelerated are no longer so
+        https://bugs.webkit.org/show_bug.cgi?id=30453
+
+        The change in r49633, to not run accelerated animations/transitions on layers that
+        are not attached, broke accelerated transitions/animations in many cases where they start
+        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
+        attached.
+        
+        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, build the MSW source to get methods that use the MSW version of
+        PlatformModuleVersion.
+
+        * wscript:
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
+        casing.
+
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change EmptyPluginHalterClient in SVGImage to be non-static, to
+        match changes made http://trac.webkit.org/changeset/49385.
+        https://bugs.webkit.org/show_bug.cgi?id=30403
+
+        Run the following layout test sequence:
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
+          LayoutTests/svg/carto.net/scrollbar.svg
+          LayoutTests/svg/carto.net/selectionlist.svg
+
+        selectionlist.svg should not crash.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+
+2009-10-16  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add beforeload event support to V8DOMWrapper
+
+        https://bugs.webkit.org/show_bug.cgi?id=30413
+
+        LayoutTests/fast/dom/beforeload/frame-before-load.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Chrome doesn't set Content-Type for file upload when the file extension
+        is not recognized
+        https://bugs.webkit.org/show_bug.cgi?id=30433
+
+        Apparently, getMIMETypeForPath is supposed to return
+        application/octet-stream when it doesn't have a better MIME type.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Inform the application when a plugin is created or destroyed, but only if the 
+        application registered for these notifications.
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Default language translation should be determined by locale settings,
+        e.g., "en-US".
+        https://bugs.webkit.org/show_bug.cgi?id=29653
+
+        Test: fast/js/navigator-language.html
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r49644.
+        http://trac.webkit.org/changeset/49644
+        
+        We need to think about this change some more. See bug #30418 
+        for more details.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_isHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isHalted):
+        Return m_isHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_isHalted to true.
+        (WebCore::PluginView::restart):
+        clear m_isHalted.
+
+2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Build fix for QtWebKit after r49649.
+
+        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed - build fix.
+
+        Web Inspector: add file missing in r49648
+
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: introduce test controller with waitUntilDone
+        on frontend side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30400
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27895
+        
+        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
+        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
+        the HTML Base element, HTML Object element, inline and external script tags, and
+        JavaScript multi-line variants of all of these attacks.
+
+        Tests: http/tests/security/xssAuditor/base-href-comment.html
+               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
+               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
+               http/tests/security/xssAuditor/img-onerror-comment.html
+               http/tests/security/xssAuditor/object-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
+               http/tests/security/xssAuditor/script-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-with-source-comment.html
+
+        * page/XSSAuditor.cpp: Added constant minAttackLength.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
+        to minAttackLength of script code plus context (if any).
+        * page/XSSAuditor.h:
+
+2009-10-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Currently, Skia clip paths are 1-bit. This patch makes our path
+        clipping anti-aliased for non-canvas drawing.
+
+        http://code.google.com/p/chromium/issues/detail?id=5927
+        https://bugs.webkit.org/show_bug.cgi?id=28820
+        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+
+        Already covered by layout tests. New baselines will be needed in the
+        Chromium tree.
+
+        (Reland. First landed in r49329, reverted in r49330 due to Windows
+        build break)
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::clip):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::clipPathAntiAliased):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebCore.Video.exp: Export muted and setMute.
+
+2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transitions fail to run sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=26770
+
+        Fix an issue where we could attempt to start accelerated animations or transitions on
+        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
+        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
+        software transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        Make some methods non-inline for ease of debugging (these are not hot methods).
+        Rename m_waitingForAResponse to m_waitingForResponse.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::hasAncestor):
+        New method to report whether the receiver has the given layer as an ancestor. Used for checking
+        whether a layer is rooted.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+
+2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Refactor ProfilesPanel to support multiple profile types
+
+        Data describing different profile types are now stored in distinct objects.
+        https://bugs.webkit.org/show_bug.cgi?id=30332
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.get buttonStyle):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfile):
+        (WebInspector.CPUProfile.prototype.get title):
+        (WebInspector.CPUProfile.prototype.get uid):
+        (WebInspector.CPUProfile.prototype.get head):
+        (WebInspector.CPUProfile.prototype.createView):
+        (WebInspector.CPUProfile.prototype.viewForProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType):
+        (WebInspector.ProfileType.prototype.get buttonTooltip):
+        (WebInspector.ProfileType.prototype.get buttonStyle):
+        (WebInspector.ProfileType.prototype.get buttonCaption):
+        (WebInspector.ProfileType.prototype.get id):
+        (WebInspector.ProfileType.prototype.get name):
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._makeKey):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.getProfileType):
+        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
+        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addProfileHeader):
+        (WebInspector.setRecordingProfile):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.showProfileForURL):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enable inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GStreamer] READY state doesn't mean "enough data"
+        https://bugs.webkit.org/show_bug.cgi?id=30003
+
+        STATE_READY means MediaPlayer::HaveNothing
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30002
+
+        implement cancelLoad
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30353
+        
+        Fix race condition, leading to a deadlock
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (webkit_video_sink_class_init):
+        Fix race condition in unlock/render that would lead to deadlocks.
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30374
+        
+        Check if caps are valid before parsing them
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+        Check if caps are valid before parsing them in ::naturalSize().
+        This prevents assertions if the natural size should be calculated
+        before the video caps are negotiated.
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30006
+        [GStreamer] Unnecessary checks for Messages types in callbacks
+
+        refactored gst message callbacks into a single one
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Adele Peterson.
+
+        Anchor elements should be mouse focusable regardless isLink flag.
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+
+2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Return correct shorthand property name for 
+        background-repeat-x, background-repeat-y, background-position-x,
+        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
+        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+
+        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Create and update frontend script objects only when
+        web inspector is visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30376
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Fix Windows build.
+
+        * dom/Document.idl:
+
+2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [HTML5] Add document.head
+        https://bugs.webkit.org/show_bug.cgi?id=30232
+
+        Test is fast/dom/document-head.html
+
+        * dom/Document.idl: added readonly attribute head
+
+2009-10-14  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
+        https://bugs.webkit.org/show_bug.cgi?id=30347
+        https://bugs.webkit.org/show_bug.cgi?id=22772
+
+        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Move scrolling code from FrameLoader to FrameView
+        https://bugs.webkit.org/show_bug.cgi?id=30370
+
+        This code is about controlling the Frame's view, not about loading
+        stuff into the frame.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::scrollToAnchor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragment):
+        (WebCore::FrameView::scrollToAnchor):
+        * page/FrameView.h:
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        [XSSAuditor] Add an exception for local files
+        https://bugs.webkit.org/show_bug.cgi?id=30352
+
+        Reduce XSS auditor false positives by always letting pages load scripts
+        from their own host. We don't actually know of any false positives
+        that this prevents, but it seems like a good idea.
+
+        One subtly is that we don't add this exception for scripts that have a
+        query string because (1) URLs with query strings are more apt to
+        confuse servers and (2) it is much less common to load scripts with a
+        query string.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
+               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+
+2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Kill virtual contextElement() method spread all over SVG code
+        https://bugs.webkit.org/show_bug.cgi?id=30183
+
+        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
+        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
+        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
+
+        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
+        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::synchronize):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGCircleElement.h: Ditto.
+        * svg/SVGClipPathElement.h: Ditto.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGDefsElement.h: Ditto.
+        * svg/SVGEllipseElement.h: Ditto.
+        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
+        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
+        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGLineElement.h: Ditto.
+        * svg/SVGMPathElement.h: Ditto. Fix license indention.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGMaskElement.h: Ditto.
+        * svg/SVGPathElement.h: Ditto.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
+        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGRectElement.h: Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGSwitchElement.h: Ditto.
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
+        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
+        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
+        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Masking with wrong offset
+        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+
+        SVGMaskElement moves the mask image graphics context to the wrong location.
+        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
+        is not used in the later calculation. Fix by consistenly calculating the translation
+        offsets from the final mask destination rect.
+
+        Test: svg/custom/mask-with-default-value.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Jon Honeycutt.
+        
+        Export a few more showSubstituteImage() related methods.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-14  Mark Seaborn  <mseaborn@google.com>
+
+        Reviewed by Darin Adler.
+
+        Check error return value in Perl build script
+        https://bugs.webkit.org/show_bug.cgi?id=30316
+
+        * css/makevalues.pl: Die if gperf fails.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG wrong filterRegions for userSpaceOnUse and percentage values
+        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+
+        Some clean-up of the SVG filter calculation code. This clean-up
+        also fixes the problem with percentage and userSpaceInUse mode.
+
+        Test: svg/filters/subRegion-in-userSpace.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::buildFilter):
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::~SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::create):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        The last change fixed the problem, removing diagnostic printfs.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix for versions < 7.18.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        One more round of changes to figure out why the webgl 
+        tests are crashing on the build bot. Here I am trying
+        to see if we can create a software renderer. I am also
+        printing the found pixel formats.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
+ 
+        Reviewed by Simon Hausmann.
+ 
+        Enabling NPAPI plugin support on Qt Webkit for S60 platform
+        https://bugs.webkit.org/show_bug.cgi?id=29302
+
+        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
+        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
+        <norbert.leser@nokia.com>
+         
+        * WebCore.pro:
+        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
+        new plugin files to be compiled under symbian: macro
+
+        * bridge/npapi.h:
+        Added NPEvent and NPRegion definition for Symbian
+
+        * plugins/PluginPackage.h:
+        Added S60 specific plugin interface and plugin loader variables
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
+        Default implementation to be used only for non-symbian platform
+        * plugins/PluginDatabase.cpp:
+        Macro !SYMBIAN checking
+        * plugins/PluginView.h:
+        Add Symbian to platforms that support setNPWindowIfNeeded
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
+        call setNPWindowRect from setFrameRect
+         
+        Added folder 'symbian' which contains implementation files for S60
+        platform-specific NPAPI plugin functionality, under /plugins folder
+        * plugins/symbian
+        * plugins/symbian/npinterface.h:
+        Plugin Interface to be implemented by S60 NPAPI plugins 
+        * plugins/symbian/PluginContainerSymbian.h:
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        * plugins/symbian/PluginDatabaseSymbian.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        More changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Round non-integer line height values.
+
+        Change webkit to rounding non-integer line height values
+        instead of truncating them. This fixes a layout test
+        failure on Windows and matches the calculation in IE and Firefox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=24434
+
+        Test: fast/css/line-height-rounding.html
+              fast/forms/textarea-scrollbar-height.htm
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-10-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
+        interfaces to be more consistent with the JavaScript profiler.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::startTimelineProfiler):
+        (WebCore::InspectorBackend::stopTimelineProfiler):
+        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
+        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+
+2009-10-01  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix crash when loading invalid image data
+        https://bugs.webkit.org/show_bug.cgi?id=29980
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setImageSizeForAltText):
+
+2009-10-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for NULL ptr deref in canvas's toDataURL().
+        https://bugs.webkit.org/show_bug.cgi?id=30254
+
+        Test: fast/canvas/canvas-toDataURL-crash.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed, reverting r49558 since it broke profiler tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        ImageDecoderQt: Minor tweaks to the decoder
+
+        - Only cache the data when we start to use it.
+        - Start with a repetition count of none for normal images.
+        - Do not use canRead as this will trigger parsing of the full image
+        - Cope with a GIF failing to decode the first frame, do not
+          set m_failed to true if decoding the first frame failed
+        - Inform the QImageReader about the format that was detected
+        - Always create a ImageDecoderQt when when we have more
+        than four byte.
+
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
+        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
+        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
+        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
+        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
+        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
+        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
+        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't collect call frame properties until they're needed for completion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30334
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
+        * inspector/front-end/ScriptsPanel.js:
+
+>>>>>>> .r49765
+2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29106
+        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+
+        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
+        compiler aggressively resolve inheritance of class R.  
+        
+        The winscw compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+        
+        The change should be reverted when the above bug is fixed in winscw compiler.
+
+        * loader/CachedResourceHandle.h:
+        (WebCore::::CachedResourceHandle):
+
+2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49554, because it broke Win and Chromium builds.
+        http://trac.webkit.org/changeset/49554
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
+        While we're rebaselining scrollbars, fix an off by one in the vertical
+        scrollbar rendering too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30319
+
+        Tests: this is covered by every pixel test involving scrollbars.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+
+2009-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix issue where clientX and clientY on MouseEvents were wrong when
+        the page was zoomed and scrolled.
+
+        Test: fast/events/clientXY-in-zoom-and-scroll.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX): Take page zoom into account.
+        (WebCore::contentsY): Ditto.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
+        out into separate ones for scripts and stylesheets.
+
+        * WebCore.base.exp:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        (WebCore::PageGroup::userStyleSheets):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Chrome's "Skia" theme paints select controls backwards in RTL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30320
+
+        Test: fast/text/international/bidi-menulist.html
+        (The test is about something else, but it includes RTL selects.)
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30318
+        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
+        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
+        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+
+        Tests:
+        Test adds event listener to a DocumentType Node which is created without a document
+        and then dispatches the event after attaching a node to the tree. Event
+        should fire when node is attached to the tree.
+
+        * fast/events/add-event-without-document-expected.txt: Added.
+        * fast/events/add-event-without-document.html: Added.
+
+        All changes in files below are the same - remove the code that calls
+        EventTarget::scriptExecutionContext and checks it for NULL.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        Cleaned up bitrot in SharedWorker V8 bindings.
+
+        * WebCore.gypi:
+        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8SharedWorkerContext.cpp.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * bindings/v8/V8Index.h:
+        Added definition for SHAREDWORKERCONTEXT wrapper.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        Added includes for SharedWorker.h and SharedWorkerContext.h.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
+        Also added field indexes for SharedWorkers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        Added runtime enabler for the SharedWorker constructor.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Cleaned up bitrot (various APIs have changed since this file was written).
+        * page/DOMWindow.idl:
+        Added EnabledAtRuntime flag to window.SharedWorker.
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30345
+        HTTP tests for credential handling fail on Tiger
+
+        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
+        let it do its work without intervention. Once again, we pass explicitly passed credentials
+        in URL, fixing regressions from Safari 3.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Adam Barth.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Reworked and added to the getter/setter interface in ChromiumDataObject:
+        - added contains...() methods to just query the state
+        - added containsValid...URL() methods for URL data members
+        - removed takeFileNames() as this was too type-dependent
+        - changed return type of fileNames() to Vector<String>
+        - added interface methods to allow appending to and iteration over file names
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::containsMainURL):
+        (WebCore::ChromiumDataObject::containsValidMainURL):
+        (WebCore::ChromiumDataObject::containsMainURLTitle):
+        (WebCore::ChromiumDataObject::containsTextPlain):
+        (WebCore::ChromiumDataObject::containsTextHTML):
+        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsContent):
+        (WebCore::ChromiumDataObject::containsContentFileExtension):
+        (WebCore::ChromiumDataObject::containsContentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::containsFileNames):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::clearFileNames):
+        (WebCore::ChromiumDataObject::countFileNames):
+        (WebCore::ChromiumDataObject::fileNameAt):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::appendToFileNames):
+        (WebCore::ChromiumDataObject::popFileName):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Visibility:visible inside a compositing layer doesn't make the element visible
+        https://bugs.webkit.org/show_bug.cgi?id=30339
+        
+        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
+        only consulted hasVisibleContent(), which does not take into a account child layers which
+        may be visible. We also have to consult hasVisibleDescendant() as well.
+
+        Test: compositing/compositing-visible-descendant.html
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
+        from the make system into common code.
+
+        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
+        support is not enabled.
+
+        Remove notImplemented() from PluginPackageNone.cpp and 
+        PluginDataNone.cpp make them just empty functions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginDataNone.cpp:
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * plugins/PluginPackageNone.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30150
+        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+
+        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+
+        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
+        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
+        converts null strings to non-null @"".
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by Dimitri Glazkov.
+
+        window attributes (like localStorage) that are disabled at runtime are still visible
+        https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        Adding codegen/bindings to support runtime disabling of attributes.
+
+        No new tests (only supported by chrome currently)
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
+        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):
+        Refactored attribute setting code into a common inline routine.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::configureAttribute):
+        Inline function which configures a single attribute given a BatchedAttribute struct.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * page/DOMWindow.idl:
+        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+
+2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27457
+        Added support for static validation on type=email input elements as per
+        HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+
+        Test: fast/forms/ValidityState-typeMismatch-email.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
+        performs validation on type=email input elements now.
+        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
+        * html/ValidityState.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Event listeners installed on a window object returned from window.open() don't work
+        https://bugs.webkit.org/show_bug.cgi?id=28716
+
+        Tests: http/tests/security/window-events-clear-domain.html
+               http/tests/security/window-events-clear-port.html
+               http/tests/security/window-events-pass.html
+
+        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
+        window event handlers when implicitOpen is called. It is called in 2 cases - on
+        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+
+        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
+        event handlers, to preserve the behavior of document.open().
+
+        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
+        does not remove window event handlers.
+
+        * dom/Document.h: Removed clear().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
+        if we transition from temporary empty document to a loaded one.
+
+        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
+        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leak in the inspector by calling didRemoveNode with
+        an error code when it fails, instead of returning from the
+        Backend.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
+        Web Inspector: Should be able to delete nodes from the Elements Tree.
+        
+        When the delete key is pressed and a element is selected in the tree,
+        the element should be deleted from the Elements Tree and the DOM.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didRemoveNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        
+        Set pointer-events: none on the new overlay so mouseover events are passed
+        to the resources graph so we can show timings.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+       https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build system fix. Typo in a filename.
+
+        * GNUmakefile.am:
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+        Alter profile link format to enable multiple profile types
+        https://bugs.webkit.org/show_bug.cgi?id=30253
+
+        The new profile URL includes the profile type along with the
+        profile title and uid.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.linkifyStringAsFragment):
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix same-named profiles grouping in the Profiles panel.
+
+        The tree node re-parenting while adding a new group node was broken.
+         
+        https://bugs.webkit.org/show_bug.cgi?id=30299
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enforce async interaction between inspector controller and frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30300
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch.delayDispatch):
+        (WebInspector.dispatch):
+
+2009-10-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
+        scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30034
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        JavaScript bindings of WebSocket addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        Test: fast/websockets/websocket-event-target.html
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * websockets/WebSocket.idl:
+
+2009-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
+        <rdar://problem/7288221>
+
+        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::pruneBlacklistedCodecs):
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-10-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
+        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
+        for the Objective-C wrapper class as well.
+
+        Added fast/dom/beforeload/frame-before-load.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isBeforeLoadEvent):
+        * dom/Event.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-10-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix <rdar://problem/7094146> Reproducible crash at
+        RenderObject::localToAbsolute()
+
+        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+
+        The crash was caused by stale positioned objects lists following an
+        object transitioning from being absolutely position to being fixed
+        positioned.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): In case of a transition between
+        absolute and fixed position, mark the parent as having a child needing
+        layout, so that this object will get inserted into its new container's
+        positioned objects list.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
+        this transition, so that this object gets removed from its current
+        container's positioned objects list.
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a palette() method that is needed by our RenderTheme.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Gradients can't handle percentage values in userSpaceOnUse mode
+        [https://bugs.webkit.org/show_bug.cgi?id=30286]
+
+        Fixed *GradientAttributes to take SVGLength instead of double. This casues
+        the problem, that we can't calculate the correct size of a gradient on
+        userSpaceOnUse mode with percentage values.
+
+        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
+
+        * svg/LinearGradientAttributes.h:
+        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
+        (WebCore::LinearGradientAttributes::x1):
+        (WebCore::LinearGradientAttributes::y1):
+        (WebCore::LinearGradientAttributes::x2):
+        (WebCore::LinearGradientAttributes::y2):
+        (WebCore::LinearGradientAttributes::setX1):
+        (WebCore::LinearGradientAttributes::setY1):
+        (WebCore::LinearGradientAttributes::setX2):
+        (WebCore::LinearGradientAttributes::setY2):
+        * svg/RadialGradientAttributes.h:
+        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
+        (WebCore::RadialGradientAttributes::cx):
+        (WebCore::RadialGradientAttributes::cy):
+        (WebCore::RadialGradientAttributes::r):
+        (WebCore::RadialGradientAttributes::fx):
+        (WebCore::RadialGradientAttributes::fy):
+        (WebCore::RadialGradientAttributes::setCx):
+        (WebCore::RadialGradientAttributes::setCy):
+        (WebCore::RadialGradientAttributes::setR):
+        (WebCore::RadialGradientAttributes::setFx):
+        (WebCore::RadialGradientAttributes::setFy):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+
+2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30315>.
+        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        
+        Add tooltip text to the Load event and DOM Content event lines through
+        a new layer that allows these lines to be on top of the view.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/inspector.css:
+
+2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49429, because it broke layout tests.
+        http://trac.webkit.org/changeset/49429
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
+2009-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added automatic flush before compositing
+        https://bugs.webkit.org/show_bug.cgi?id=30236
+
+        This causes image to always render correctly. In writing a testcase
+        I needed to implement readPixels. This exposed a bug in reading back
+        values from a CanvasArray subclass, so I fixed that as well. Now when
+        you wrap a CanvasArray in a JSValue it actually wraps the specific
+        subclass. To do this I need to add virtual methods to each CanvasArray
+        subclass to determine the type and a custom toJS method for CanvasArray
+        to create the proper wrapper. 
+
+        Test: fast/canvas/webgl/triangle.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayCustom.cpp:
+        (WebCore::toJS):
+        * html/canvas/CanvasArray.h:
+        (WebCore::CanvasArray::isByteArray):
+        (WebCore::CanvasArray::isUnsignedByteArray):
+        (WebCore::CanvasArray::isShortArray):
+        (WebCore::CanvasArray::isUnsignedShortArray):
+        (WebCore::CanvasArray::isIntArray):
+        (WebCore::CanvasArray::isUnsignedIntArray):
+        (WebCore::CanvasArray::isFloatArray):
+        * html/canvas/CanvasArray.idl:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::isByteArray):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::isFloatArray):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::isIntArray):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::readPixels):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::isShortArray):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30307
+        
+        Fix 0 sentinel for g_object_set() function call.
+
+        * platform/graphics/gtk/DataSourceGStreamer.cpp:
+        (webkit_data_src_uri_set_uri):
+        0 is passed as 32 bit value on x86-64 in vararg functions, but
+        g_object_set() expects a 64 bit 0. This will cause crashes.
+
+2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop in="" from <feFlood>
+        https://bugs.webkit.org/show_bug.cgi?id=29001
+
+        This makes <feFlood in="bogus"> have an effect, too.
+
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+
+        Test: svg/dom/feFlood-no-in1.html
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29998
+        
+        Scale video to completely fill the target surface while
+        keeping the aspect ratio. This fixes displaying of the
+        YouTube HTML5 sample website.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Scale video to completely fill the target surface, keep
+        the aspect ratio and center it.
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29997
+        
+        Fixes double memcpy of all rendered video frames.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        Directly pass the buffers up to the MediaPlayerPrivate::paint()
+        method instead of rendering them first to an intermediate cairo
+        surface. This should increase performance and peak memory usage.
+
+2009-10-11  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30242
+        
+        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
+        bypass the XSSAuditor.
+        
+        JavaScript URLs that are completed by method Document::completeURL have added
+        URL-encoded characters such that a direct comparison with the URL-decoded 
+        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
+        HTTP parameters must be URL-decoded before comparison.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
+        the URL-decoded source code for the JavaScript URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
+        parameter decodeURLEscapeSequencesTwice.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fixes a build break in the V8 bindings caused by revision 49420.
+        https://bugs.webkit.org/show_bug.cgi?id=30294
+
+        Revision 49420 introduces an IDL-defined CanvasActiveInfo
+        type. This causes a build break in the V8 bindings where
+        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
+        non-ref type.
+
+        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
+        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
+          ptr type.
+        * bindings/v8/DOMObjectsInclude.h: Include generated
+          CanvasActiveInfo files.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-10-11  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Log mixed content warnings to console
+
+        https://bugs.webkit.org/show_bug.cgi?id=30290
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+
+2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
+        https://bugs.webkit.org/show_bug.cgi?id=30250
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+
+        https://bugs.webkit.org/show_bug.cgi?id=30244
+
+        This change requires no test case as it fix a compiling error.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Sets a 500K stack limit for JavaScript workers in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29797
+
+        Runaway recursion in JavaScript workers crashes the Chromium
+        worker process on OS X. This is because V8's default stack limit
+        is 512K on ia32 or 1M on x64, but the worker process runs workers
+        on a thread with the OS X default stack size--512K. Because there
+        are already some C+frames on the stack when V8 establishes its
+        512K default stack limit, and V8 doesn't precisely enforce the
+        stack limit, runaway recursion in V8 workers overflows the OS
+        stack and segfaults, killing the worker process. This is described
+        in Chromium bug 21653 <http://crbug.com/21653>.
+
+        This patch sets the V8 stack limit for worker JavaScript in
+        Chromium to a more conservative 500K on all platforms. This allows
+        some "headroom" for the C+stack in use when the limit is set up,
+        and some "legroom" for the V8 helper functions which in practice
+        briefly flout the V8 stack limit.
+
+        Test: LayoutTests/fast/workers/use-machine-stack.html
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Sam Weinig.
+
+        Allow [Reflect] on SVG elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28936
+
+        Update the JS binding generators to reference SVGNames instead of
+        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
+        SVGElement::id use [Reflect].
+
+        Also make [Reflect] on an attribute with a setter exception work in ObjC
+        bindings.
+
+        Test: svg/dom/id-reflect.html
+
+        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
+        appropriate C+namespace for attribute name constants.
+        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
+        code for [Reflect] on an attribute with a setter exception.
+        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
+        "HTMLNames" when appropriate.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/SVGElement.cpp: Remove getter and setter methods for id.
+        * svg/SVGElement.h: Ditto.
+        * svg/SVGElement.idl: Add [Reflect] to id.
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix paths in xcode.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Implement getActiveAttrib and getActiveUniform
+        https://bugs.webkit.org/show_bug.cgi?id=30276
+
+        Implements the getActiveAttrib and getActiveUniform APIs.
+        Rather simple patch, adds CanvasActiveInfo definition and implementation
+        and adds forwarding to the GraphicsContext3D.
+
+        Test: fast/canvas/webgl/getActiveTest.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasActiveInfo.h: Added.
+        (WebCore::CanvasActiveInfo::create):
+        (WebCore::CanvasActiveInfo::name):
+        (WebCore::CanvasActiveInfo::type):
+        (WebCore::CanvasActiveInfo::size):
+        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
+        * html/canvas/CanvasActiveInfo.idl: Added.
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+          Need to make the context public as it is needed to ensure we don't
+          provide a program from one context as an argument to another.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
+        (WebCore::CanvasRenderingContext3D::getActiveUniform):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+
+2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adding new attributes in Element Panel is
+        counterintuitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30057
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30275
+
+        In addition to fixing the build break with guards
+        remove notImplemented() from PluginViewNone.cpp and
+        make them just just be empty functions.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49415.
+
+        Add HistoryController.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
+        https://bugs.webkit.org/show_bug.cgi?id=30262
+
+        This is not testable from WebKit since WebKit never uses the member
+        function form of protocolIs with input that can be controlled from a
+        web page.  It always passes string literals lacking hyphens.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
+        transform the input character.
+
+2009-10-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move HistoryController to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=30272
+
+        Purely mechanical.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp: Added.
+        * loader/HistoryController.h: Added.
+
+2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ApplyStyleCommand removes presentational tags even when not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=28091
+
+        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
+        (triggering removal of tag) only if the style implicitly added by the element is not present in
+        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
+        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
+        style span when the style attribute is empty.
+
+        Test: editing/execCommand/toggle-style-3.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
+        decoration is not present in the style to apply
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
+        returns true if the tag is used in new style
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
+        with the surrounding identical elements
+        * editing/ApplyStyleCommand.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        HistoryController is in charge of managing the current / previous /
+        provisional HistoryItems.  The split isn't perfect, but it's a place to
+        start.  I'll move HistoryController into its own file in another patch.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::HistoryController::HistoryController):
+        (WebCore::HistoryController::~HistoryController):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::begin):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::setCurrentItem):
+        (WebCore::HistoryController::setProvisionalItem):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::didFirstLayout):
+        (WebCore::HistoryController::updateForFrameLoadCompleted):
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::receivedMainResourceError):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
+        (WebCore::HistoryController::createHistoryItem):
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
+        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
+        (WebCore::HistoryController::createHistoryItemTree):
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::HistoryController::urlsMatchItem):
+        (WebCore::HistoryController::goToItem):
+        (WebCore::HistoryController::recursiveGoToItem):
+        (WebCore::HistoryController::childFramesMatchItem):
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::updateForAnchorScroll):
+        (WebCore::HistoryController::saveDocumentAndScrollState):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::FrameLoader::didChangeTitle):
+        * loader/FrameLoader.h:
+        (WebCore::HistoryController::current):
+        (WebCore::HistoryController::provisional):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - fixing an obvious typo in my previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Fixes existing tests (which I thought I had run the previous time).
+
+        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
+        set by reference.
+
+2009-10-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
+        https://bugs.webkit.org/show_bug.cgi?id=30264
+
+        The base class method changed in r48884.
+
+        Test: fast/worker/worker-script-error.html
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Tests: http/tests/xmlhttprequest/logout.html
+               http/tests/xmlhttprequest/re-login-async.html
+               http/tests/xmlhttprequest/re-login.html
+
+        Fix several issues with existing credential handling code.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
+        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
+        want to iterate paths for origins that never had credentials associated with them. Changed
+        to use a separate HashSet for this.
+        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
+        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
+        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
+        is now PathToDefaultProtectionSpaceMap.
+        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
+        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
+        (WebCore::CredentialStorage::set): Updated for above changes.
+        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
+        a prefix in OriginToDefaultBasicCredentialMap.
+        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
+        URL default protection space. It does nothing if the given URL doesn't correspond to a known
+        protection space.
+        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
+
+        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
+        protection space and those that deduce one from URL more clear.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
+        This makes the following pattern work:
+          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
+          req.send("");
+          req.abort();
+        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
+        Note that one cannot log in using the same method, because there isn't a known protection
+        space for the URL yet in that case, so the added code has no effect.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
+        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
+        course), and matches sync case.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Renamed getDefaultAuthenticationCredential() to get().
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac code.
+
+2009-10-09  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Undoing a indent removes text instead of it's formatting.
+        <rdar://problem/7169206>
+        https://bugs.webkit.org/show_bug.cgi?id=28722
+        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
+        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        
+        Added editing/undo/undo-indent.html test.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
+        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
+        ensure TextIterator could correctly calculate the position starting from the index.
+        * editing/IndentOutdentCommand.h: Restored.
+
+2009-10-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+        
+        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=30186
+
+        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
+        detect no-ops and return this instead of creating a new instance.
+        Empirical testing shows that the majority of calls to these methods are no-ops, making
+        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
+        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
+        (WebCore::StringImpl::stripWhiteSpace):
+        (WebCore::StringImpl::simplifyWhiteSpace):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feGaussianBlur implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+
+        This is the implementation of GaussianBlur filter for SVG.
+
+        There is already a test for feGaussianBlur
+        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+
+        Test: svg/filters/feGaussianBlur.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isAlphaImage):
+        (WebCore::FilterEffect::setIsAlphaImage):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+        (WebCore::FEGaussianBlur::apply):
+
+2009-10-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] QoS support in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=29959
+
+        Removed the async buffer queue from the sink. Synchronize the
+        render method of the sink using a g_timeout_add() combined with a
+        gcond triggered when the buffer has been rendered.
+        Also fixed the video sink reference handling in the player, now
+        that the idle is not there anymore to mess up things.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_class_init):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
+        with the attribute "operator". It was only accessible via "_operator" 
+        on JavaScript.
+
+        Test: svg/dom/operatorAttribute.xhtml
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.SVG.Filters.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEMorphologyElement.cpp: Added.
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::setRadius):
+        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/SVGFEMorphologyElement.h: Added.
+        * svg/SVGFEMorphologyElement.idl: Added.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::operator<<):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::):
+        * svg/svgtags.in:
+
+2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Chromium breakage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+
 2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -8,6 +4129,1156 @@
 
         * platform/qt/QWebPageClient.h:
 
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
+        ImageEventSender that can be used by both load and beforeload events.  If the document has any
+        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
+        and will be held up until the beforeload event can fire at a later date.
+
+        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
+        in the typical parsing case we don't have to put off the beforeload/load events until after
+        a layout or paint might already have happened.  This lets beforeload/load not cause extra
+        layouts and repaints.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
+        (WebCore::beforeLoadEventSender):
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
+        (WebCore::ImageLoader::dispatchPendingEvents):
+        (WebCore::ImageEventSender::ImageEventSender):
+        (WebCore::ImageEventSender::dispatchEventSoon):
+        (WebCore::ImageEventSender::cancelEvent):
+        (WebCore::ImageEventSender::dispatchPendingEvents):
+        (WebCore::ImageEventSender::timerFired):
+        * loader/ImageLoader.h:
+        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::attach):
+
+2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30174
+
+        No tests due to no Script* test infrastructure.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        
+        'client' is 0 when we have no view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30251
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Add missing setCurrentPlugin(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30248
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+
+2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] beforeload event does not fire on script elements in XML
+        https://bugs.webkit.org/show_bug.cgi?id=30235
+
+        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
+        made in XMLTokenizerLibxml2.cpp.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserValueList
+        https://bugs.webkit.org/show_bug.cgi?id=30249
+
+        Inherits CSSParserValueList class from FastAllocBase because it has 
+        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+
+        * css/CSSParserValues.h:
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30214
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        This fixes a leak of WebPluginHalterClients:
+        https://bugs.webkit.org/show_bug.cgi?id=30119.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.base.exp:
+        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyPluginHalterClient::enabled):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Remove initialization of m_pluginHalterClient, which was removed. If a
+        non-null PluginHalterClient was passed, create the PluginHalter, and
+        set its allowed run time.
+
+        * page/Page.h:
+        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::didStartPlugin):
+        Check whether the PluginHalterClient is enabled.
+        (WebCore::PluginHalter::didStopPlugin):
+        Ditto.
+
+        * page/PluginHalter.h:
+        Made m_client an OwnPtr.
+
+        * page/PluginHalterClient.h:
+        Added a function to return the enabled state.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Remove initialization of removed member.
+
+        * page/Settings.h:
+        Removed settings for the enabled state of the PluginHalter; we now use
+        the existence of a WebPluginHalterDelegate to determine whether the
+        PluginHalter is enabled.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        These methods have virtually no interaction with FrameLoader.  They
+        really seem like they ought to belong to ScriptController.
+
+        * WebCore.base.exp:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptController.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::replaceDocument):
+        * loader/FrameLoader.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing #include.
+
+        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
+        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        
+        Make sure to call update script object if we have an InspectorFrontend to
+        call it on when we get one of the new events.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated for removal of Structure::markAggregate().
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2009-10-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make AtomicString create its StringImpl via create(), not the constructor,
+        so it gets allocated in a single heap block, saving memory and CPU cycles.
+        This eliminates two StringImpl constructors, making the remaining ones
+        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
+        Added const attribute to UChar* in StringImpl constructor, eliminating the
+        need for several const_casts in calls to it.
+        StringImpl also unfriends AtomicString (OMG drama!!!)
+        https://bugs.webkit.org/show_bug.cgi?id=30141
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::CStringTranslator::translate): Call StringImpl::create().
+        (WebCore::UCharBufferTranslator::translate): Ditto.
+        (WebCore::HashAndCharactersTranslator::translate): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
+        (WebCore::StringImpl::adopt): Ditto.
+        (WebCore::StringImpl::createUninitialized): Ditto.
+        (WebCore::StringImpl::create): Ditto.
+        (WebCore::StringImpl::crossThreadString): Ditto.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL frame loader client function.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
+        which wasn't exposed until a clean build.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * bindings/v8/V8Index.cpp:
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        unselectable resources in resource panel
+        https://bugs.webkit.org/show_bug.cgi?id=30079
+
+        manual test added
+        
+        Also changed the way DnD for resources in the Resources panel is 
+        handled.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
+        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30233>
+        Local Storage and Cookies show Blank Titles on Local Files.
+
+        If a local storage or cookies sidebar item has no domain, set the 
+        title to "Local Files", because that is what it represents.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
+        document, since video/audio (and images eventually too) can load when not in the document yet.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30230
+
+        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
+        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
+        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+
+        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
+        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPatternElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Correct a typo that fixes the resizing of columns in Cookie view when you
+        resize the Inspector window.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
+        Text in Inspector's Styles gear menu is invisible.
+        
+        Adds a style rule for the option text and hr's in the gear menu,
+        to prevent them from being transparent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Fix build problem with SVGURIReference in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * WebCore.gypi:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Make beforeload work on <video>/<audio> elements.
+
+        Added fast/dom/beforeload/video-before-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30218
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        * svg/SVGDefsElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        * svg/SVGLineElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C+DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
 2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
@@ -20,6 +5291,3817 @@
 
         * WebCore.pro:
 
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C+EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
 2009-09-29  Dave Hyatt  <hyatt@apple.com>
 
         Reviewed by Jon Honeycutt.
@@ -582,7 +9664,7 @@
         * platform/network/qt/QNetworkReplyHandler.cpp:
         (WebCore::QNetworkReplyHandler::finish):
 
-009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
@@ -1655,7 +10737,7 @@
         can't happen when working with JavaScript since the Element will be kept
         alive due to the change above.
         (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
         missing braces.
 
         * dom/NamedAttrMap.h: Made the element function public so it can be used by
@@ -1778,7 +10860,7 @@
         1. if the insertion node has a non opaque background color and one of the parent element did have
         a solid background color the new paragraph did not have the element with the solid color in the tree.
         2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
-        background color and some font attribute was being reproduced as span + bold + italic + font as separate tags.
+        background color and some font attribute was being reproduced as span bold italic font as separate tags.
         The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
         paragraph where the insertion point is.
 
@@ -2114,7 +11196,7 @@
 
         Reviewed by Oliver Hunt.
 
-        Implement correct horizontal scrollbar behavior for GTK+ also on
+        Implement correct horizontal scrollbar behavior for GTKalso on
         styled scrollbars.
 
         https://bugs.webkit.org/show_bug.cgi?id=29348
@@ -3988,7 +13070,7 @@
 
 2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Unreviewed build fix for GTK+ and a blind one for Qt after r48566.
+        Unreviewed build fix for GTKand a blind one for Qt after r48566.
 
         * GNUmakefile.am:
         * WebCore.pro:
@@ -4742,7 +13824,7 @@
         Reviewed by Oliver Hunt.
 
         <rdar://problem/7007541> 
-        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
         
         Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
         crashes while we're calling into it).
@@ -6024,7 +15106,7 @@
 
         Reviewed by Dan Bernstein.
 
-        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() + 436
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
         
         Avoid a crash when a mouse event handler on a <select> changes the select from a popup
         to a list (by setting the 'size' property) inside the event handler.
@@ -7040,7 +16122,7 @@
 
         Reviewed by Gustavo Noronha.
 
-        Build fix for GTK+ after r48267.
+        Build fix for GTKafter r48267.
 
         * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
         (WebCore::MediaPlayerPrivate::buffered):
@@ -8081,7 +17163,7 @@
 
 2009-09-08  Xan Lopez  <xlopez@igalia.com>
 
-        Unreviewed attempt to fix the GTK+ build.
+        Unreviewed attempt to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -13747,7 +22829,7 @@
         do not set playbin's audio sink.
         * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
         * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func): Use C++ casts, decrease reference count of async
+        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
         queue at the end of the idle function.
         (webkit_video_sink_render): Increase reference count of async queue.
         (webkit_video_sink_stop): Remove any idle functions with the sink as data.
@@ -15508,7 +24590,7 @@
 
         Reviewed by Eric Seidel.
 
-        Add 'icu::' qualifier when refering to ICU C++ names to the other
+        Add 'icu::' qualifier when refering to ICU C+names to the other
         file with this issue missed in the previous check-in.
 
         https://bugs.webkit.org/show_bug.cgi?id=28410
@@ -15791,7 +24873,7 @@
 
         Reviewed by Eric Seidel
 
-        Add 'icu::' qualifier when refering to ICU C++ names.
+        Add 'icu::' qualifier when refering to ICU C+names.
 
         https://bugs.webkit.org/show_bug.cgi?id=28410
 
@@ -19969,7 +29051,7 @@ form controls that have different validity states.
         Reviewed by Sam Weinig.
 
         <rdar://problem/6952336>
-        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const + 27
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
 
         Make sure to set the security origin before calling dispatchWindowObjectAvailable.
         
@@ -20293,11 +29375,11 @@ form controls that have different validity states.
         Reviewed by Darin Adler.
 
         https://bugs.webkit.org/show_bug.cgi?id=28204
-        Allow C++ exceptions to be disabled in WebCore's V8 Mac build.
+        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
 
         * WebCorePrefix.h:
         Only undefine |try| and |catch| when building Objective-C[++],
-        leaving the C++ library definitions intact for C++.
+        leaving the C+library definitions intact for C++.
 
 2009-08-12  Nate Chapin  <japhet@chromium.org>
 
@@ -21347,7 +30429,7 @@ form controls that have different validity states.
 
         Reviewed by Darin Fisher.
 
-        Cleanup DOM Storage namespace shutdown code + usage of security origin.
+        Cleanup DOM Storage namespace shutdown code usage of security origin.
         https://bugs.webkit.org/show_bug.cgi?id=28094
 
         If a storage namespace is not explicitly closed, be sure to do so on
@@ -21454,7 +30536,7 @@ form controls that have different validity states.
 
 2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
-        Fix GTK+ build.
+        Fix GTKbuild.
 
         * platform/network/soup/ResourceHandleSoup.cpp:
         (WebCore::):
@@ -21468,7 +30550,7 @@ form controls that have different validity states.
         * platform/graphics/GlyphBuffer.h: Removed advanceData().
         * platform/graphics/wince/GraphicsContextWince.cpp:
         (WebCore::GraphicsContext::drawText): Changed to use advances(from)
-            instead of advanceData() + from.
+            instead of advanceData() from.
 
 2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
@@ -21781,7 +30863,7 @@ form controls that have different validity states.
 
         Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
         The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
-        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload + 2'.
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
 
         Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
 
@@ -29091,7 +38173,7 @@ form controls that have different validity states.
 
         I decided to change these to Base:: instead of DOMObjectWithGlobal::
         for future-proofing.  All autogenerated classes use a typedef Base
-        to avoid bugs like these.  Sadly C++ does not have a built-in super:: we could use.
+        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
 
         * WebCore.xcodeproj/project.pbxproj:
         * bindings/js/JSAbstractWorkerCustom.cpp:
@@ -29959,7 +39041,7 @@ form controls that have different validity states.
 
 2009-07-22  Xan Lopez  <xlopez@igalia.com>
 
-        Attempt to fix the GTK+ build.
+        Attempt to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -36020,7 +45102,7 @@ form controls that have different validity states.
 
         Crash in RenderMedia::styleDidChange.
         <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
-        media element (RenderMedia::styleDidChange + 115)
+        media element (RenderMedia::styleDidChange 115)
 
         Speculative fix for crash in styleDidChange. Null check controller elements before tell
         them to update style.
@@ -37138,7 +46220,7 @@ form controls that have different validity states.
 
         Not reviewed, Chromium build fix.
 
-        Add in missing header + fix syntax issue that crept into last patch.
+        Add in missing header fix syntax issue that crept into last patch.
         https://bugs.webkit.org/show_bug.cgi?id=27027
 
         * rendering/RenderThemeChromiumMac.mm:
@@ -37969,7 +47051,7 @@ form controls that have different validity states.
 
         Report the caret offset from the end of the selection, otherwise
         we'll report the same offset when moving the caret while
-        modififying the selection (eg, with Shift + Right).
+        modififying the selection (eg, with Shift Right).
 
         * editing/gtk/SelectionControllerGtk.cpp:
         (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
@@ -39238,7 +48320,7 @@ form controls that have different validity states.
 
         Reviewed by Geoff Garen.
 
-        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const + 62
+        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
 
         <select> elements and other elements the produce popups can keep their popups
         live across a page load.  If this occurs and the <select> element has an
@@ -39894,7 +48976,7 @@ form controls that have different validity states.
 
         Reviewed by Jan Alonzo.
 
-        [GTK] Don't use deprecated GTK+ symbols.
+        [GTK] Don't use deprecated GTKsymbols.
         https://bugs.webkit.org/show_bug.cgi?id=26583
 
         * plugins/gtk/gtk2xtbin.c:
@@ -45387,7 +54469,7 @@ form controls that have different validity states.
 
         Reviewed by Brady Eidson.
 
-        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient + 53
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
         
         When revalidating a resource, calling addClient() on one client might cause another to get removed.
         
@@ -45449,7 +54531,7 @@ form controls that have different validity states.
         Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
         Provide an assignment operator to avoid improper reference
         counts on the Cairo font objects.  This brings the Windows
-        Cairo port in line with the GTK+ port.
+        Cairo port in line with the GTKport.
 
         * platform/graphics/win/FontPlatformData.h:
         * platform/graphics/win/FontPlatformDataCairoWin.cpp:
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index 2131793..be83136 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -28,6 +28,7 @@
 #include "JSAbstractWorker.cpp"
 #include "JSAttr.cpp"
 #include "JSBarInfo.cpp"
+#include "JSBeforeLoadEvent.cpp"
 #include "JSCanvasGradient.cpp"
 #include "JSCanvasPattern.cpp"
 #include "JSCanvasRenderingContext.cpp"
@@ -243,6 +244,7 @@
 #include "JSSVGFEImageElement.cpp"
 #include "JSSVGFEMergeElement.cpp"
 #include "JSSVGFEMergeNodeElement.cpp"
+#include "JSSVGFEMorphologyElement.cpp"
 #include "JSSVGFEOffsetElement.cpp"
 #include "JSSVGFEPointLightElement.cpp"
 #include "JSSVGFESpecularLightingElement.cpp"
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
new file mode 100644
index 0000000..661c61a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ExceptionHelpers_h
+#define WebCore_FWD_ExceptionHelpers_h
+#include <JavaScriptCore/ExceptionHelpers.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSCell.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSCell.h
new file mode 100644
index 0000000..83a1575
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSCell.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JSCell_h
+#define WebCore_FWD_JSCell_h
+#include <JavaScriptCore/JSCell.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StructureChain.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StructureChain.h
new file mode 100644
index 0000000..7c60fa7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StructureChain.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_StructureChain_h
+#define WebCore_FWD_StructureChain_h
+#include <JavaScriptCore/StructureChain.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/WebCore.3DRendering.exp b/src/3rdparty/webkit/WebCore/WebCore.3DRendering.exp
new file mode 100644
index 0000000..4a84c63
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.3DRendering.exp
@@ -0,0 +1 @@
+_WebCoreHas3DRendering
diff --git a/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp b/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp
index b0244db..5698258 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.SVG.Filters.exp
@@ -15,6 +15,7 @@
 .objc_class_name_DOMSVGFEImageElement
 .objc_class_name_DOMSVGFEMergeElement
 .objc_class_name_DOMSVGFEMergeNodeElement
+.objc_class_name_DOMSVGFEMorphologyElement
 .objc_class_name_DOMSVGFEOffsetElement
 .objc_class_name_DOMSVGFEPointLightElement
 .objc_class_name_DOMSVGFESpecularLightingElement
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Video.exp b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
new file mode 100644
index 0000000..5d35698
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
@@ -0,0 +1,14 @@
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement8setMutedEb
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore16HTMLMediaElement6rewindEf
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement13platformMediaEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index 43e739c..c0da0ec 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -31,6 +31,7 @@
             'css/WebKitCSSMatrix.idl',
             'css/WebKitCSSTransformValue.idl',
             'dom/Attr.idl',
+            'dom/BeforeLoadEvent.idl',
             'dom/CDATASection.idl',
             'dom/CharacterData.idl',
             'dom/ClientRect.idl',
@@ -76,6 +77,7 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
+            'html/canvas/CanvasActiveInfo.idl',
             'html/canvas/CanvasArray.idl',
             'html/canvas/CanvasArrayBuffer.idl',
             'html/canvas/CanvasBuffer.idl',
@@ -258,6 +260,7 @@
             'svg/SVGFEImageElement.idl',
             'svg/SVGFEMergeElement.idl',
             'svg/SVGFEMergeNodeElement.idl',
+            'svg/SVGFEMorphologyElement.idl',
             'svg/SVGFEOffsetElement.idl',
             'svg/SVGFEPointLightElement.idl',
             'svg/SVGFESpecularLightingElement.idl',
@@ -345,7 +348,6 @@
             'svg/SVGTransform.idl',
             'svg/SVGTransformList.idl',
             'svg/SVGTransformable.idl',
-            'svg/SVGURIReference.idl',
             'svg/SVGUnitTypes.idl',
             'svg/SVGUseElement.idl',
             'svg/SVGViewElement.idl',
@@ -428,6 +430,8 @@
             'bindings/js/DOMObjectWithSVGContext.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
+            'bindings/js/JSCallbackData.cpp',
+            'bindings/js/JSCallbackData.h',
             'bindings/js/JSAttrCustom.cpp',
             'bindings/js/JSAudioConstructor.cpp',
             'bindings/js/JSAudioConstructor.h',
@@ -482,6 +486,8 @@
             'bindings/js/JSEventListener.h',
             'bindings/js/JSEventTarget.cpp',
             'bindings/js/JSEventTarget.h',
+            'bindings/js/JSExceptionBase.cpp',
+            'bindings/js/JSExceptionBase.h',
             'bindings/js/JSGeolocationCustom.cpp',
             'bindings/js/JSHistoryCustom.cpp',
             'bindings/js/JSHistoryCustom.h',
@@ -622,6 +628,7 @@
             'bindings/js/StringSourceProvider.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
+            'bindings/ScriptControllerBase.cpp',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
@@ -669,6 +676,7 @@
             'bindings/v8/custom/V8EventCustom.cpp',
             'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
@@ -678,8 +686,10 @@
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
             'bindings/v8/custom/V8HTMLIFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLImageElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLImageElementConstructor.h',
             'bindings/v8/custom/V8HTMLInputElementCustom.cpp',
             'bindings/v8/custom/V8HTMLOptionElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
@@ -761,8 +771,11 @@
             'bindings/v8/ScriptState.h',
             'bindings/v8/ScriptState.cpp',
             'bindings/v8/ScriptString.h',
+            'bindings/v8/ScriptStringImpl.cpp',
+            'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/SerializedScriptValue.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -799,8 +812,6 @@
             'bindings/v8/V8NPUtils.h',
             'bindings/v8/V8NodeFilterCondition.cpp',
             'bindings/v8/V8NodeFilterCondition.h',
-            'bindings/v8/V8ObjectEventListener.cpp',
-            'bindings/v8/V8ObjectEventListener.h',
             'bindings/v8/V8Proxy.cpp',
             'bindings/v8/V8Proxy.h',
             'bindings/v8/V8SVGPODTypeWrapper.h',
@@ -808,8 +819,6 @@
             'bindings/v8/V8Utilities.h',
             'bindings/v8/V8WorkerContextEventListener.cpp',
             'bindings/v8/V8WorkerContextEventListener.h',
-            'bindings/v8/V8WorkerContextObjectEventListener.cpp',
-            'bindings/v8/V8WorkerContextObjectEventListener.h',
             'bindings/v8/WorkerContextExecutionProxy.h',
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
@@ -961,6 +970,7 @@
             'dom/Attribute.h',
             'dom/BeforeTextInsertedEvent.cpp',
             'dom/BeforeTextInsertedEvent.h',
+            'dom/BeforeLoadEvent.h',
             'dom/BeforeUnloadEvent.cpp',
             'dom/BeforeUnloadEvent.h',
             'dom/CDATASection.cpp',
@@ -1611,6 +1621,8 @@
             'loader/FrameLoader.h',
             'loader/FrameLoaderClient.h',
             'loader/FrameLoaderTypes.h',
+            'loader/HistoryController.cpp',
+            'loader/HistoryController.h',
             'loader/ImageDocument.cpp',
             'loader/ImageDocument.h',
             'loader/ImageLoader.cpp',
@@ -1627,12 +1639,20 @@
             'loader/PlaceholderDocument.h',
             'loader/PluginDocument.cpp',
             'loader/PluginDocument.h',
+            'loader/PolicyCallback.cpp',
+            'loader/PolicyCallback.h',
+            'loader/PolicyChecker.cpp',
+            'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
             'loader/ProgressTracker.h',
+            'loader/RedirectScheduler.cpp',
+            'loader/RedirectScheduler.h',
             'loader/Request.cpp',
             'loader/Request.h',
             'loader/ResourceLoader.cpp',
             'loader/ResourceLoader.h',
+            'loader/ResourceLoadNotifier.cpp',
+            'loader/ResourceLoadNotifier.h',
             'loader/SubresourceLoader.cpp',
             'loader/SubresourceLoader.h',
             'loader/SubresourceLoaderClient.h',
@@ -1823,7 +1843,7 @@
             'platform/chromium/KeyboardCodesWin.h',
             'platform/chromium/Language.cpp',
             'platform/chromium/LinkHashChromium.cpp',
-            'platform/chromium/MimeTypeRegistryChromium.cpp',
+            'platform/chromium/MIMETypeRegistryChromium.cpp',
             'platform/chromium/PasteboardChromium.cpp',
             'platform/chromium/PasteboardPrivate.h',
             'platform/chromium/PlatformCursor.h',
@@ -1921,6 +1941,8 @@
             'platform/graphics/filters/FEComponentTransfer.h',
             'platform/graphics/filters/FEComposite.cpp',
             'platform/graphics/filters/FEComposite.h',
+            'platform/graphics/filters/FEGaussianBlur.cpp',
+            'platform/graphics/filters/FEGaussianBlur.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -2935,6 +2957,8 @@
             'rendering/RenderMarquee.h',
             'rendering/RenderMedia.cpp',
             'rendering/RenderMedia.h',
+            'rendering/RenderMediaControlsChromium.cpp',
+            'rendering/RenderMediaControlsChromium.h',
             'rendering/RenderMenuList.cpp',
             'rendering/RenderMenuList.h',
             'rendering/RenderObject.cpp',
@@ -3105,6 +3129,7 @@
             'storage/StorageAreaSync.h',
             'storage/StorageEvent.cpp',
             'storage/StorageEvent.h',
+            'storage/StorageEventDispatcher.cpp',
             'storage/StorageEventDispatcher.h',
             'storage/StorageMap.cpp',
             'storage/StorageMap.h',
@@ -3129,8 +3154,6 @@
             'svg/graphics/filters/SVGFEDisplacementMap.h',
             'svg/graphics/filters/SVGFEFlood.cpp',
             'svg/graphics/filters/SVGFEFlood.h',
-            'svg/graphics/filters/SVGFEGaussianBlur.cpp',
-            'svg/graphics/filters/SVGFEGaussianBlur.h',
             'svg/graphics/filters/SVGFEImage.cpp',
             'svg/graphics/filters/SVGFEImage.h',
             'svg/graphics/filters/SVGFEMerge.cpp',
@@ -3275,6 +3298,8 @@
             'svg/SVGFEMergeElement.h',
             'svg/SVGFEMergeNodeElement.cpp',
             'svg/SVGFEMergeNodeElement.h',
+            'svg/SVGFEMorphologyElement.cpp',
+            'svg/SVGFEMorphologyElement.h',
             'svg/SVGFEOffsetElement.cpp',
             'svg/SVGFEOffsetElement.h',
             'svg/SVGFEPointLightElement.cpp',
@@ -3456,6 +3481,8 @@
             'svg/SVGZoomAndPan.h',
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
+            'svg/SynchronizablePropertyController.cpp',
+            'svg/SynchronizablePropertyController.h',
             'svg/SynchronizableTypeWrapper.h',
             'websockets/WebSocket.cpp',
             'websockets/WebSocket.h',
@@ -3470,8 +3497,6 @@
             'workers/DedicatedWorkerContext.h',
             'workers/DedicatedWorkerThread.cpp',
             'workers/DedicatedWorkerThread.h',
-            'workers/DefaultSharedWorkerRepository.cpp',
-            'workers/DefaultSharedWorkerRepository.h',
             'workers/GenericWorkerTask.h',
             'workers/SharedWorker.cpp',
             'workers/SharedWorker.h',
@@ -3613,6 +3638,7 @@
             'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
+            'inspector/front-end/TestController.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TimelineAgent.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
@@ -3621,6 +3647,7 @@
             'inspector/front-end/View.js',
             'inspector/front-end/WatchExpressionsSidebarPane.js',
             'inspector/front-end/inspector.css',
+            'inspector/front-end/inspectorSyntaxHighlight.css',
         ],
         'webinspector_image_files': [
 
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index ff42e26..c1040e2 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -7851,6 +7851,7 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
 __ZN7WebCore19InspectorController5closeEv
 __ZN7WebCore15BackForwardList5closeEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index a0a072d..a835fc7 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -87,19 +87,6 @@ win32-g++ {
     QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
 }
 
-# Temporary workaround to pick up the DEF file from the same place as all the others
-symbian {
-    shared {
-        MMP_RULES -= defBlock
-
-        MMP_RULES += "$${LITERAL_HASH}ifdef WINSCW" \
-                    "DEFFILE ../../../s60installs/bwins/$${TARGET}.def" \
-                    "$${LITERAL_HASH}elif defined EABI" \
-                    "DEFFILE ../../../s60installs/eabi/$${TARGET}.def" \
-                    "$${LITERAL_HASH}endif"
-    }
-}
-
 # Assume that symbian OS always comes with sqlite
 symbian:!CONFIG(QTDIR_build): CONFIG += system-sqlite
 
@@ -177,7 +164,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    unix|win32-*:!embedded:!wince*:!symbian {
+    unix|win32-*:!embedded:!wince*: {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
     } else {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
@@ -309,7 +296,8 @@ STYLESHEETS_EMBED = \
     $$PWD/css/svg.css \
     $$PWD/css/view-source.css \
     $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css
 
 DOMLUT_FILES += \
     bindings/js/JSDOMWindowBase.cpp \
@@ -343,6 +331,7 @@ IDL_BINDINGS += \
     css/WebKitCSSMatrix.idl \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
     dom/CharacterData.idl \
     dom/ClientRect.idl \
     dom/ClientRectList.idl \
@@ -558,6 +547,7 @@ IDL_BINDINGS += \
     svg/SVGFEImageElement.idl \
     svg/SVGFEMergeElement.idl \
     svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEMorphologyElement.idl \
     svg/SVGFEOffsetElement.idl \
     svg/SVGFEPointLightElement.idl \
     svg/SVGFESpecularLightingElement.idl \
@@ -682,6 +672,7 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
     bindings/js/JSCanvasRenderingContextCustom.cpp \
@@ -710,6 +701,7 @@ SOURCES += \
     bindings/js/JSEventSourceConstructor.cpp \
     bindings/js/JSEventSourceCustom.cpp \
     bindings/js/JSEventTarget.cpp \
+    bindings/js/JSExceptionBase.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
@@ -776,6 +768,8 @@ SOURCES += \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
+    bindings/js/SerializedScriptValue.cpp \
+    bindings/ScriptControllerBase.cpp \
     bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
@@ -1110,6 +1104,7 @@ SOURCES += \
     loader/DocumentThreadableLoader.cpp \
     loader/FormState.cpp \
     loader/FrameLoader.cpp \
+    loader/HistoryController.cpp \
     loader/FTPDirectoryDocument.cpp \
     loader/FTPDirectoryParser.cpp \
     loader/icon/IconLoader.cpp \
@@ -1122,9 +1117,13 @@ SOURCES += \
     loader/NetscapePlugInStreamLoader.cpp \
     loader/PlaceholderDocument.cpp \
     loader/PluginDocument.cpp \
+    loader/PolicyCallback.cpp \
+    loader/PolicyChecker.cpp \
     loader/ProgressTracker.cpp \
+    loader/RedirectScheduler.cpp \
     loader/Request.cpp \
     loader/ResourceLoader.cpp \
+    loader/ResourceLoadNotifier.cpp \
     loader/SubresourceLoader.cpp \
     loader/TextDocument.cpp \
     loader/TextResourceDecoder.cpp \
@@ -1187,6 +1186,7 @@ SOURCES += \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
+    platform/image-decoders/qt/RGBA32BufferQt.cpp \
     platform/graphics/FontDescription.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
@@ -1380,6 +1380,7 @@ HEADERS += \
     bindings/js/CachedScriptSourceProvider.h \
     bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
     bindings/js/JSCustomPositionCallback.h \
@@ -1440,6 +1441,7 @@ HEADERS += \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
     bindings/js/WorkerScriptController.h \
     bridge/c/c_class.h \
@@ -1863,6 +1865,7 @@ HEADERS += \
     platform/DragImage.h \
     platform/FileChooser.h \
     platform/GeolocationService.h \
+    platform/image-decoders/ImageDecoder.h \
     platform/mock/GeolocationServiceMock.h \
     platform/graphics/BitmapImage.h \
     platform/graphics/Color.h \
@@ -2098,7 +2101,6 @@ HEADERS += \
     svg/graphics/filters/SVGFEDiffuseLighting.h \
     svg/graphics/filters/SVGFEDisplacementMap.h \
     svg/graphics/filters/SVGFEFlood.h \
-    svg/graphics/filters/SVGFEGaussianBlur.h \
     svg/graphics/filters/SVGFEImage.h \
     svg/graphics/filters/SVGFEMerge.h \
     svg/graphics/filters/SVGFEMorphology.h \
@@ -2162,6 +2164,7 @@ HEADERS += \
     svg/SVGFELightElement.h \
     svg/SVGFEMergeElement.h \
     svg/SVGFEMergeNodeElement.h \
+    svg/SVGFEMorphologyElement.h \
     svg/SVGFEOffsetElement.h \
     svg/SVGFEPointLightElement.h \
     svg/SVGFESpecularLightingElement.h \
@@ -2249,6 +2252,7 @@ HEADERS += \
     svg/SVGViewSpec.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
+    svg/SynchronizablePropertyController.h \
     wml/WMLAccessElement.h \
     wml/WMLAElement.h \
     wml/WMLAnchorElement.h \
@@ -2346,7 +2350,6 @@ SOURCES += \
     platform/graphics/qt/ImageBufferQt.cpp \
     platform/graphics/qt/ImageDecoderQt.cpp \
     platform/graphics/qt/ImageQt.cpp \
-    platform/graphics/qt/ImageSourceQt.cpp \
     platform/graphics/qt/IntPointQt.cpp \
     platform/graphics/qt/IntRectQt.cpp \
     platform/graphics/qt/IntSizeQt.cpp \
@@ -2456,46 +2459,61 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
 
-    unix {
-        DEFINES += ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1
+    symbian {
+        SOURCES += \
+        plugins/symbian/PluginPackageSymbian.cpp \
+        plugins/symbian/PluginDatabaseSymbian.cpp \
+        plugins/symbian/PluginViewSymbian.cpp \
+        plugins/symbian/PluginContainerSymbian.cpp
 
-        mac {
-            SOURCES += \
-                plugins/mac/PluginPackageMac.cpp \
-                plugins/mac/PluginViewMac.cpp
-            OBJECTIVE_SOURCES += \
-                platform/text/mac/StringImplMac.mm \
-                platform/mac/WebCoreNSStringExtras.mm
-            INCLUDEPATH += platform/mac
-            # Note: XP_MACOSX is defined in npapi.h
-        } else {
-            !embedded: CONFIG += x11
-            SOURCES += \
-                plugins/qt/PluginContainerQt.cpp \
-                plugins/qt/PluginPackageQt.cpp \
-                plugins/qt/PluginViewQt.cpp
-            HEADERS += \
-                plugins/qt/PluginContainerQt.h
-            DEFINES += XP_UNIX
-        }
-    }
+        HEADERS += \
+        plugins/symbian/PluginContainerSymbian.h \
+        plugins/symbian/npinterface.h
 
-    win32-* {
-        INCLUDEPATH += $$PWD/plugins/win
-
-        SOURCES += page/win/PageWin.cpp \
-                   plugins/win/PluginDatabaseWin.cpp \
-                   plugins/win/PluginPackageWin.cpp \
-                   plugins/win/PluginMessageThrottlerWin.cpp \
-                   plugins/win/PluginViewWin.cpp
-
-        LIBS += \
-            -ladvapi32 \
-            -lgdi32 \
-            -lshell32 \
-            -lshlwapi \
-            -luser32 \
-            -lversion
+        LIBS += -lefsrv
+
+    } else {
+
+        unix {
+    
+            mac {
+                SOURCES += \
+                    plugins/mac/PluginPackageMac.cpp \
+                    plugins/mac/PluginViewMac.cpp
+                OBJECTIVE_SOURCES += \
+                    platform/text/mac/StringImplMac.mm \
+                    platform/mac/WebCoreNSStringExtras.mm
+                INCLUDEPATH += platform/mac
+                # Note: XP_MACOSX is defined in npapi.h
+            } else {
+                !embedded: CONFIG += x11
+                SOURCES += \
+                    plugins/qt/PluginContainerQt.cpp \
+                    plugins/qt/PluginPackageQt.cpp \
+                    plugins/qt/PluginViewQt.cpp
+                HEADERS += \
+                    plugins/qt/PluginContainerQt.h
+                DEFINES += XP_UNIX
+            }
+        }
+    
+        win32-* {
+            INCLUDEPATH += $$PWD/plugins/win
+    
+            SOURCES += page/win/PageWin.cpp \
+                       plugins/win/PluginDatabaseWin.cpp \
+                       plugins/win/PluginPackageWin.cpp \
+                       plugins/win/PluginMessageThrottlerWin.cpp \
+                       plugins/win/PluginViewWin.cpp
+    
+            LIBS += \
+                -ladvapi32 \
+                -lgdi32 \
+                -lshell32 \
+                -lshlwapi \
+                -luser32 \
+                -lversion
+        }
     }
 
 } else {
@@ -2605,6 +2623,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageAreaImpl.h \
         storage/StorageAreaSync.h \
         storage/StorageEvent.h \
+        storage/StorageEventDispatcher.h \
         storage/Storage.h \
         storage/StorageMap.h \
         storage/StorageNamespace.h \
@@ -2619,6 +2638,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageAreaImpl.cpp \
         storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
+        storage/StorageEventDispatcher.cpp \
         storage/StorageMap.cpp \
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
@@ -2756,6 +2776,7 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FEColorMatrix.cpp \
         platform/graphics/filters/FEComponentTransfer.cpp \
         platform/graphics/filters/FEComposite.cpp \
+        platform/graphics/filters/FEGaussianBlur.cpp \
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
@@ -2900,6 +2921,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGFELightElement.cpp \
         svg/SVGFEMergeElement.cpp \
         svg/SVGFEMergeNodeElement.cpp \
+        svg/SVGFEMorphologyElement.cpp \
         svg/SVGFEOffsetElement.cpp \
         svg/SVGFEPointLightElement.cpp \
         svg/SVGFESpecularLightingElement.cpp \
@@ -2986,6 +3008,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGViewElement.cpp \
         svg/SVGViewSpec.cpp \
         svg/SVGZoomAndPan.cpp \
+        svg/SynchronizablePropertyController.cpp \
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
@@ -2993,7 +3016,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/filters/SVGFEDiffuseLighting.cpp \
         svg/graphics/filters/SVGFEDisplacementMap.cpp \
         svg/graphics/filters/SVGFEFlood.cpp \
-        svg/graphics/filters/SVGFEGaussianBlur.cpp \
         svg/graphics/filters/SVGFEImage.cpp \
         svg/graphics/filters/SVGFEMerge.cpp \
         svg/graphics/filters/SVGFEMorphology.cpp \
diff --git a/src/3rdparty/webkit/WebCore/WebCore.qrc b/src/3rdparty/webkit/WebCore/WebCore.qrc
index b3fe43a..69f860a 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.qrc
+++ b/src/3rdparty/webkit/WebCore/WebCore.qrc
@@ -1,7 +1,4 @@
 <!DOCTYPE RCC><RCC version="1.0">
-<qresource prefix="/webcore/css">
-    <file alias="mediaControls-extras.css">css/qt/mediaControls-extras.css</file>
-</qresource>
 <qresource prefix="/webkit/resources">
     <file alias="missingImage.png">Resources/missingImage.png</file>
     <file alias="nullPlugin.png">Resources/nullPlugin.png</file>
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
index a807ab9..7200de9 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -101,6 +101,7 @@ MediaControlElementType AccessibilityMediaControl::controlType() const
 
 String AccessibilityMediaControl::controlTypeName() const
 {
+    DEFINE_STATIC_LOCAL(const String, mediaFullscreenButtonName, ("FullscreenButton"));
     DEFINE_STATIC_LOCAL(const String, mediaMuteButtonName, ("MuteButton"));
     DEFINE_STATIC_LOCAL(const String, mediaPlayButtonName, ("PlayButton"));
     DEFINE_STATIC_LOCAL(const String, mediaSeekBackButtonName, ("SeekBackButton"));
@@ -114,6 +115,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
 
     switch (controlType()) {
+    case MediaFullscreenButton:
+        return mediaFullscreenButtonName;
     case MediaMuteButton:
         return mediaMuteButtonName;
     case MediaPlayButton:
diff --git a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
new file mode 100644
index 0000000..4d73d83
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
@@ -0,0 +1,84 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
+#include "Settings.h"
+#include "XSSAuditor.h"
+
+namespace WebCore {
+
+ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
+{
+    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()));
+}
+
+ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
+{
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluate(sourceCode);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
+bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
+{
+    if (!protocolIsJavaScript(url))
+        return false;
+
+    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
+        return true;
+
+    const int javascriptSchemeLength = sizeof("javascript:") - 1;
+
+    String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
+    ScriptValue result;
+    if (xssAuditor()->canEvaluateJavaScriptURL(script))
+        result = executeScript(script, userGesture);
+
+    String scriptResult;
+    if (!result.getString(scriptResult))
+        return true;
+
+    // FIXME: We should always replace the document, but doing so
+    //        synchronously can cause crashes:
+    //        http://bugs.webkit.org/show_bug.cgi?id=16782
+    if (replaceDocument) 
+        m_frame->loader()->replaceDocument(scriptResult);
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 9411ad8..a6cbd91 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -46,10 +46,6 @@ namespace WebCore {
 
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -60,10 +56,6 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
new file mode 100644
index 0000000..d08f760
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCallbackData.h"
+
+#include "Document.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+    
+namespace WebCore {
+
+void JSCallbackData::deleteData(void* context)
+{
+    delete static_cast<JSCallbackData*>(context);
+}
+
+JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedException)
+{
+    ASSERT(callback());
+    ASSERT(globalObject());
+
+    ExecState* exec = globalObject()->globalExec();
+    
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = callback()->getCallData(callData);
+        if (callType == CallTypeNone)
+            return JSValue();
+        function = callback();
+    }
+    
+    globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = call(exec, function, callType, callData, callback(), args);
+    globalObject()->globalData()->timeoutChecker.stop();
+
+    Document::updateStyleForAllDocuments();
+
+    if (exec->hadException()) {
+        reportCurrentException(exec);
+        if (raisedException)
+            *raisedException = true;
+        return result;
+    }
+    
+    return result;
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
new file mode 100644
index 0000000..4fc9f84
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCallbackData_h
+#define JSCallbackData_h
+
+#include "JSDOMGlobalObject.h"
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+// We have to clean up this data on the main thread because unprotecting a
+// JSObject on a non-main thread without synchronization would corrupt the heap
+// (and synchronization would be slow).
+
+class JSCallbackData {
+public:
+    static void deleteData(void*);
+
+    JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+    
+    ~JSCallbackData()
+    {
+        ASSERT(isMainThread());
+    }
+
+    JSC::JSObject* callback() { return m_callback.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
+    
+    JSC::JSValue invokeCallback(JSC::MarkedArgumentBuffer&, bool* raisedException = 0);
+
+private:
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
+
+} // namespace WebCore
+
+#endif // JSCallbackData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
index 44c9000..5f1254e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -47,8 +47,9 @@ namespace WebCore {
         //
         RefPtr<C> arrayObject;
         
+        // For the 0 args case, just create an object without a buffer 
         if (args.size() < 1)
-            return 0;
+            return C::create(0, 0, 0);
         
         if (args.at(0).isObject()) {
             RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
index 4aa1547..14548d7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -29,6 +29,13 @@
 
 #include "config.h"
 #include "JSCanvasArray.h"
+#include "JSCanvasByteArray.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include "JSCanvasShortArray.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include "JSCanvasFloatArray.h"
 
 #include "CanvasArray.h"
 
@@ -38,17 +45,21 @@ namespace WebCore {
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
 {
-    if (!object)
-        return jsUndefined();
-        
-    
-
-#if ENABLE(3D_CANVAS)
-    if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
-#endif
-    ASSERT(object->is2d());
-    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+    if (object->isFloatArray())
+        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
+    if (object->isUnsignedByteArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
+    if (object->isByteArray())
+        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
+    if (object->isIntArray())
+        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
+    if (object->isUnsignedIntArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
+    if (object->isShortArray())
+        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
+    if (object->isUnsignedShortArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index 7074423..e5f83aa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -36,45 +36,19 @@ namespace WebCore {
 using namespace JSC;
 
 JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-
-    ExecState* exec = m_globalObject->globalExec();
-    
-    JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
     RefPtr<JSCustomPositionCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
-
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-    
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
index 15a166a..ad5528d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -26,14 +26,14 @@
 #ifndef JSCustomPositionCallback_h
 #define JSCustomPositionCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionCallback.h"
-#include "JSDOMGlobalObject.h"
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
 class Geoposition;
+class JSDOMGlobalObject;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
@@ -46,9 +46,8 @@ private:
     JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     virtual void handleEvent(Geoposition*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index 9109cd1..bd64deb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -36,45 +36,20 @@ namespace WebCore {
 using namespace JSC;
 
 JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
+    RefPtr<JSCustomPositionErrorCallback> protect(this);
 
-    ExecState* exec = m_globalObject->globalExec();
-    
     JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
-    RefPtr<JSCustomPositionErrorCallback> protect(this);
-    
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-    
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index d97e967..59328ca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -26,9 +26,8 @@
 #ifndef JSCustomPositionErrorCallback_h
 #define JSCustomPositionErrorCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionErrorCallback.h"
-#include "JSDOMGlobalObject.h"
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -45,9 +44,8 @@ public:
 private:
     JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
     virtual void handleEvent(PositionError*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index cdeda8f..1f6bd95 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -36,55 +36,38 @@
 #include "JSSQLResultSet.h"
 #include "JSSQLTransaction.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
     
-void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-        
-    ExecState* exec = m_globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
-        
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-
-        raisedException = true;
-    }
 
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index e6600c5..259aecf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,9 +31,8 @@
 
 #if ENABLE(DATABASE)
 
-#include "JSDOMGlobalObject.h"
+#include "JSCallbackData.h"
 #include "SQLStatementCallback.h"
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -46,14 +45,15 @@ public:
     {
         return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
     }
+    
+    virtual ~JSCustomSQLStatementCallback();
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
     JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index ea47c64..6178509 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -32,70 +32,51 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
 #include "JSSQLTransaction.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+
+JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-        
-    ExecState* exec = m_globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_callback->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return true;
-        }
-    }
+bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+{
+    ASSERT(m_data);
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-        
-    JSValue result;
-    m_globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
-    else
-        result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-            
+    
+    bool raisedException = false;
+    JSValue result = m_data->invokeCallback(args, &raisedException);
+    if (raisedException) {
         // The spec says:
         // "If the error callback returns false, then move on to the next statement..."
         // "Otherwise, the error callback did not return false, or there was no error callback"
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-        
-    Document::updateStyleForAllDocuments();
-
     return result.toBoolean(exec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e03ac35..ac4e45f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -37,7 +37,8 @@
 #include <wtf/Forward.h>
 
 namespace WebCore {
-    
+
+class JSCallbackData;    
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
@@ -46,14 +47,15 @@ public:
     {
         return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
     }
-        
+
+    virtual ~JSCustomSQLStatementErrorCallback();
+
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
     JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 1886345..456022f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
@@ -48,42 +49,17 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread because unprotecting the 
-// JSObject on a non-main thread would register that thread for JavaScript
-// garbage collection, which could unnecessarily slow things down.
-
-class JSCustomSQLTransactionCallback::Data {
-public:
-    Data(JSObject* callback, JSDOMGlobalObject* globalObject)
-        : m_callback(callback)
-        , m_globalObject(globalObject)
-    {
-    }
-
-    JSObject* callback() { return m_callback; }
-    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
-
-private:
-    ProtectedPtr<JSObject> m_callback;
-    ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-};
-
 JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_data(new Data(callback, globalObject))
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
 #endif
 }
 
-void JSCustomSQLTransactionCallback::deleteData(void* context)
-{
-    delete static_cast<Data*>(context);
-}
-
 JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 {
-    callOnMainThread(deleteData, m_data);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
 #ifndef NDEBUG
     m_data = 0;
     counter.decrement();
@@ -93,47 +69,14 @@ JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bool& raisedException)
 {
     ASSERT(m_data);
-    ASSERT(m_data->callback());
-    ASSERT(m_data->globalObject());
 
-    JSDOMGlobalObject* globalObject = m_data->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
-
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_data->callback()->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-    }
-        
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
-
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
-    else
-        call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-        
-        raisedException = true;
-    }
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
     
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index f7f78f2..f142e59 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -41,6 +41,7 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSCallbackData;
 class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
@@ -57,10 +58,7 @@ public:
 private:
     JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    static void deleteData(void*);
-
-    class Data;
-    Data* m_data;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index b2f8280..331e014 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -32,54 +32,40 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
-
-    ExecState* exec = m_globalObject->globalExec();
 
-    JSC::JSLock lock(SilenceAssertionsOnly);
+JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index 42fcbce..54bf33b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -38,6 +38,7 @@
 
 namespace WebCore {
 
+class JSCallbackData;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
@@ -47,13 +48,14 @@ public:
         return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
     }
     
+    virtual ~JSCustomSQLTransactionErrorCallback();
+    
     virtual void handleEvent(SQLError*);
 
 private:
     JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 5300c42..0edd66f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -30,53 +30,38 @@
 #include "JSCustomVoidCallback.h"
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMWindowCustom.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
 JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
-    : m_callback(callback)
-    , m_globalObject(globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
+
+JSCustomVoidCallback::~JSCustomVoidCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
     
 void JSCustomVoidCallback::handleEvent()
 {
-    ASSERT(m_callback);
-    ASSERT(m_globalObject);
+    ASSERT(m_data);
 
-    ExecState* exec = m_globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-        
     RefPtr<JSCustomVoidCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
     MarkedArgumentBuffer args;
-    
-    m_globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    m_globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index f3db49f..4b8d7ea 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -36,6 +36,8 @@
 
 namespace WebCore {
 
+class JSCallbackData;
+
 class JSCustomVoidCallback : public VoidCallback {
 public: 
     static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
@@ -43,13 +45,14 @@ public:
         return adoptRef(new JSCustomVoidCallback(callback, globalObject));
     }
     
+    virtual ~JSCustomVoidCallback();
+    
     virtual void handleEvent();
     
 private:
     JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    JSCallbackData* m_data;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 49ef5e3..8634589 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -87,10 +87,6 @@ JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -101,10 +97,6 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
 
 JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 515c088..8168323 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -25,6 +25,7 @@
 #include "DOMCoreException.h"
 #include "Document.h"
 #include "EventException.h"
+#include "ExceptionBase.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
@@ -35,6 +36,7 @@
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
 #include "JSEventException.h"
+#include "JSExceptionBase.h"
 #include "JSNode.h"
 #include "JSRangeException.h"
 #include "JSXMLHttpRequestException.h"
@@ -468,6 +470,9 @@ void reportException(ExecState* exec, JSValue exception)
     UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL")).toString(exec);
     exec->clearException();
 
+    if (ExceptionBase* exceptionBase = toExceptionBase(exception))
+        errorMessage = exceptionBase->message() + ": "  + exceptionBase->description();
+
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
     ASSERT(scriptExecutionContext);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 9c0ad7e..9af45d7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -76,10 +76,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::OverridesMarkChildren | DOMObject::StructureFlags;
+
         DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
             , m_globalObject(globalObject)
@@ -106,10 +108,11 @@ namespace WebCore {
     public:
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot | JSC::ImplementsHasInstance));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::ImplementsHasInstance | JSC::OverridesMarkChildren | DOMObjectWithGlobalPointer::StructureFlags;
         DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObjectWithGlobalPointer(structure, globalObject)
         {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 372684c..53bb26b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -51,7 +51,7 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        it->second->markAggregate(markStack);
+        markStack.append(it->second->storedPrototype());
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index 00c3bbf..ce26857 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -73,6 +73,12 @@ namespace WebCore {
             {
             }
 
+            JSDOMGlobalObjectData(Destructor destructor)
+                : JSGlobalObjectData(destructor)
+                , evt(0)
+            {
+            }
+
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index fe4d59c..a04ef89 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,12 +42,6 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : impl(window)
-    , shell(shell)
-{
-}
-
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
@@ -175,6 +169,11 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     return globalData;
 }
 
+void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
+{
+    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
+}
+
 // JSDOMGlobalObject* is ignored, accesing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 09fe4bc..52c3c1d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -76,7 +76,12 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
+                , impl(window)
+                , shell(shell)
+            {
+            }
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -85,6 +90,8 @@ namespace WebCore {
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
+        static void destroyJSDOMWindowBaseData(void*);
+
         JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 7410107..deb92cb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -79,7 +79,9 @@
 #include "RegisteredEventListener.h"
 #include "ScheduledAction.h"
 #include "ScriptController.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "SharedWorkerRepository.h"
 #include "WindowFeatures.h"
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
@@ -589,7 +591,7 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
 
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
@@ -713,7 +715,9 @@ JSValue JSDOMWindow::worker(ExecState* exec) const
 #if ENABLE(SHARED_WORKERS)
 JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 {
-    return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    if (SharedWorkerRepository::isAvailable())
+        return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    return jsUndefined();
 }
 #endif
 
@@ -726,8 +730,6 @@ JSValue JSDOMWindow::webSocket(ExecState* exec) const
     Settings* settings = frame->settings();
     if (!settings)
         return jsUndefined();
-    if (!settings->experimentalWebSocketsEnabled())
-        return jsUndefined();
     return getDOMConstructor<JSWebSocketConstructor>(exec, this);
 }
 #endif
@@ -767,7 +769,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
 
@@ -781,7 +783,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         if (created)
             newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
     }
 
     return newFrame;
@@ -838,7 +840,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
             // here.
             String referrer = dynamicFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
         }
         return toJS(exec, frame->domWindow());
     }
@@ -933,7 +935,15 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
     dialogFrame->page()->chrome()->runModal();
 
-    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
+    Identifier returnValue(exec, "returnValue");
+    if (dialogWindow->allowsAccessFromNoErrorMessage(exec)) {
+        PropertySlot slot;
+        // This is safe, we have already performed the origin security check and we are
+        // not interested in any of the DOM properties of the window.
+        if (dialogWindow->JSGlobalObject::getOwnPropertySlot(exec, returnValue, slot))
+            return slot.getValue(exec, returnValue);
+    }
+    return jsUndefined();
 }
 
 JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
@@ -941,7 +951,7 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     DOMWindow* window = impl();
 
     DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
-    String message = args.at(0).toString(exec);
+    PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
 
     if (exec->hadException())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 23af340..1bb0938 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -60,10 +60,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
     private:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
+
         virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
index 493d7bd..9bff637 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -63,29 +63,21 @@ JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList&
 
 JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index e48b593..d7f8725 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -88,7 +88,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* document)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 162543d..edf9151 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Clipboard.h"
 #include "Event.h"
+#include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
@@ -46,6 +47,7 @@
 #include "JSWebKitTransitionEvent.h"
 #include "JSWheelEvent.h"
 #include "JSXMLHttpRequestProgressEvent.h"
+#include "BeforeLoadEvent.h"
 #include "ErrorEvent.h"
 #include "KeyboardEvent.h"
 #include "MessageEvent.h"
@@ -120,7 +122,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ProgressEvent, event);
-    }
+    } else if (event->isBeforeLoadEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, BeforeLoadEvent, event);
 #if ENABLE(DOM_STORAGE)
     else if (event->isStorageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, StorageEvent, event);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index 404bf11..00dfe12 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -45,10 +45,6 @@ namespace WebCore {
 
 JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -59,10 +55,6 @@ JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
new file mode 100644
index 0000000..3749eed
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.cpp
@@ -0,0 +1,64 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "config.h"

+#include "JSExceptionBase.h"

+

+#include "JSDOMCoreException.h"

+#include "JSEventException.h"

+#include "JSRangeException.h"

+#include "JSXMLHttpRequestException.h"

+#if ENABLE(SVG)

+#include "JSSVGException.h"

+#endif

+#if ENABLE(XPATH)

+#include "JSXPathException.h"

+#endif

+ 

+namespace WebCore {

+ 

+ExceptionBase* toExceptionBase(JSC::JSValue value)

+{

+    if (DOMCoreException* domException = toDOMCoreException(value))

+        return reinterpret_cast<ExceptionBase*>(domException);

+    if (RangeException* rangeException = toRangeException(value))

+        return reinterpret_cast<ExceptionBase*>(rangeException);

+    if (EventException* eventException = toEventException(value))

+        return reinterpret_cast<ExceptionBase*>(eventException);

+    if (XMLHttpRequestException* xmlHttpException = toXMLHttpRequestException(value))

+        return reinterpret_cast<ExceptionBase*>(xmlHttpException);

+#if ENABLE(SVG)

+    if (SVGException* svgException = toSVGException(value))

+        return reinterpret_cast<ExceptionBase*>(svgException);

+#endif

+#if ENABLE(XPATH)

+    if (XPathException* pathException = toXPathException(value))

+        return reinterpret_cast<ExceptionBase*>(pathException);

+#endif

+    

+    return 0;

+}

+

+} // namespace WebCore

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
new file mode 100644
index 0000000..01c6ac2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSExceptionBase.h
@@ -0,0 +1,43 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef JSExceptionBase_h

+#define JSExceptionBase_h

+

+namespace JSC {

+    

+class JSValue;

+

+}   // namespace JSC

+

+namespace WebCore {

+

+class ExceptionBase;

+

+ExceptionBase* toExceptionBase(JSC::JSValue);

+

+} // namespace WebCore

+

+#endif // JSExceptionBase_h

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
index e6fe7f5..da3a758 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -42,10 +42,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
+            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
         static const JSC::ClassInfo s_info;
+    protected:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::MasqueradesAsUndefined | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSHTMLCollection::StructureFlags;
 
     private:
         virtual bool toBoolean(JSC::ExecState*) const { return false; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index 583d971..391cacc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -66,10 +66,7 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
-#include "JavaScriptProfile.h"
 #include "JSJavaScriptCallFrame.h"
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
 #endif
 
 using namespace JSC;
@@ -122,27 +119,20 @@ JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseTableNames(ExecState* exec, const ArgList& args)
+JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
         return jsUndefined();
 
-    Database* database = toDatabase(wrapper->unwrappedObject());
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-
-    MarkedArgumentBuffer result;
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i)
-        result.append(jsString(exec, tableNames[i]));
-
-    return constructArray(exec, result);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
 
@@ -260,21 +250,6 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
 }
 
-JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    MarkedArgumentBuffer result;
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const Vector<RefPtr<Profile> >& profiles = ic->profiles();
-
-    for (size_t i = 0; i < profiles.size(); ++i)
-        result.append(toJS(exec, profiles[i].get()));
-
-    return constructArray(exec, result);
-}
-
 #endif
 
 JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
@@ -295,12 +270,12 @@ JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
 }
 
-JSValue JSInspectorBackend::wrapObject(ExecState*, const ArgList& args)
+JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
 {
-    if (args.size() < 1)
+    if (args.size() < 2)
         return jsUndefined();
 
-    return impl()->wrapObject(ScriptValue(args.at(0))).jsValue();
+    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
 }
 
 JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index aecec5e..c76a2b1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -196,7 +196,7 @@ static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bo
         return;
 
     if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
-        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
 }
 
 void JSLocation::setHref(ExecState* exec, JSValue value)
@@ -326,7 +326,7 @@ JSValue JSLocation::reload(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
index 4c61c04..2e7b2d0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -59,7 +59,7 @@ JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::A
     const UString& typeArg = args.at(0).toString(exec);
     bool canBubbleArg = args.at(1).toBoolean(exec);
     bool cancelableArg = args.at(2).toBoolean(exec);
-    const UString& dataArg = args.at(3).toString(exec);
+    PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, args.at(3));
     const UString& originArg = args.at(4).toString(exec);
     const UString& lastEventIdArg = args.at(5).toString(exec);
     DOMWindow* sourceArg = toDOMWindow(args.at(6));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 210c93e..a0a92be 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -57,10 +57,6 @@ void JSMessagePort::markChildren(MarkStack& markStack)
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -71,10 +67,6 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
index 7e90943..17b1eae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
@@ -49,7 +49,7 @@ namespace WebCore {
     template <typename T>
     inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
     {
-        String message = args.at(0).toString(exec);
+        PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
         MessagePortArray portArray;
         fillMessagePortArray(exec, args.at(1), portArray);
         if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 52f21e7..4e7d622 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -110,14 +110,6 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    Document* document = impl()->document();
-    if (!document)
-        return jsUndefined();
-        
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -128,14 +120,6 @@ JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    Document* document = impl()->document();
-    if (!document)
-        return jsUndefined();
-
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 94a92bd..9f62495 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -47,10 +47,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
+            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | JSC::OverridesHasInstance | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::JSObject::StructureFlags;
+
         JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual void markChildren(JSC::MarkStack&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 571e302..fd3742d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -50,10 +50,6 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -64,10 +60,6 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
 
 JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index d305502..bea3563 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -36,6 +36,7 @@
 #include "JSWebSocket.h"
 
 #include "KURL.h"
+#include "JSEventListener.h"
 #include "WebSocket.h"
 #include "NotImplemented.h"
 #include <runtime/Error.h>
@@ -59,7 +60,25 @@ JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
     return ret;
 }
 
-// FIXME: implement addEventListener/removeEventListener.
+JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
 
 }  // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 4b44db2..7d3f8af 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -152,10 +152,6 @@ JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 
 JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -166,10 +162,6 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 
 JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index dab0a3e..275d1fb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -56,10 +56,6 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
@@ -70,10 +66,6 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
 
 JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 9e64bce..93155e1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -125,7 +125,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->loader()->executeScript(m_code);
+        frame->script()->executeScript(m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index e7d0b75..2cd36ed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -21,6 +21,7 @@
 #define ScheduledAction_h
 
 #include "PlatformString.h"
+#include <runtime/JSCell.h>
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 8852611..77b8ca4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -86,7 +86,7 @@ void ScriptCachedFrameData::clear()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_window) {
+    if (m_window) {
         m_window = 0;
         gcController().garbageCollectSoon();
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index dfa1602..54acc90 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -48,6 +48,7 @@ ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
     , m_handlerLineNumber(0)
     , m_sourceURL(0)
+    , m_inExecuteScript(false)
     , m_processingTimerCallback(false)
     , m_paused(false)
     , m_allowPopupsFromPlugin(false)
@@ -84,7 +85,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 {
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
-    
+
     if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
@@ -185,6 +186,9 @@ bool ScriptController::processingUserGestureEvent() const
         return false;
 
     if (Event* event = m_windowShell->window()->currentEvent()) {
+        if (event->createdByDOM())
+            return false;
+
         const AtomicString& type = event->type();
         if ( // mouse events
             type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index 56e8f0c..bd4b65e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -80,6 +80,12 @@ public:
         return m_windowShell->window();
     }
 
+    ScriptValue executeScript(const ScriptSourceCode&);
+    ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+
+    // Returns true if argument is a JavaScript URL.
+    bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
     ScriptValue evaluate(const ScriptSourceCode&);
     void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
@@ -155,6 +161,8 @@ private:
     int m_handlerLineNumber;
     const String* m_sourceURL;
 
+    bool m_inExecuteScript;
+
     bool m_processingTimerCallback;
     bool m_paused;
     bool m_allowPopupsFromPlugin;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index b527a96..1172e8e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -103,6 +103,14 @@ bool ScriptObject::set(const char* name, int value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index a8b11e0..31381f3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -52,6 +52,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
new file mode 100644
index 0000000..48cd92d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -0,0 +1,839 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "SerializedScriptValue.h"
+
+#include <runtime/DateInstance.h>
+#include <runtime/ExceptionHelpers.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/HashTraits.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+class SerializedObject : public SharedSerializedData
+{
+public:
+    typedef Vector<RefPtr<StringImpl> > PropertyNameList;
+    typedef Vector<SerializedScriptValueData> ValueList;
+
+    void set(const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        ASSERT(m_names.size() == m_values.size());
+        m_names.append(String(propertyName.ustring()).crossThreadString().impl());
+        m_values.append(value);
+    }
+
+    PropertyNameList& names() { return m_names; }
+
+    ValueList& values() { return m_values; }
+
+    static PassRefPtr<SerializedObject> create()
+    {
+        return adoptRef(new SerializedObject);
+    }
+
+    void clear()
+    {
+        m_names.clear();
+        m_values.clear();
+    }
+
+private:
+    SerializedObject() { }
+    PropertyNameList m_names;
+    ValueList m_values;
+};
+
+class SerializedArray : public SharedSerializedData
+{
+    typedef HashMap<unsigned, SerializedScriptValueData, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned> > SparseMap;
+public:
+    void setIndex(unsigned index, const SerializedScriptValueData& value)
+    {
+        ASSERT(index < m_length);
+        if (index == m_compactStorage.size())
+            m_compactStorage.append(value);
+        else
+            m_sparseStorage.set(index, value);
+    }
+
+    bool canDoFastRead(unsigned index) const
+    {
+        ASSERT(index < m_length);
+        return index < m_compactStorage.size();
+    }
+
+    const SerializedScriptValueData& getIndex(unsigned index)
+    {
+        ASSERT(index < m_compactStorage.size());
+        return m_compactStorage[index];
+    }
+
+    SerializedScriptValueData getSparseIndex(unsigned index, bool& hasIndex)
+    {
+        ASSERT(index >= m_compactStorage.size());
+        ASSERT(index < m_length);
+        SparseMap::iterator iter = m_sparseStorage.find(index);
+        if (iter == m_sparseStorage.end()) {
+            hasIndex = false;
+            return SerializedScriptValueData();
+        }
+        hasIndex = true;
+        return iter->second;
+    }
+
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    static PassRefPtr<SerializedArray> create(unsigned length)
+    {
+        return adoptRef(new SerializedArray(length));
+    }
+
+    void clear()
+    {
+        m_compactStorage.clear();
+        m_sparseStorage.clear();
+        m_length = 0;
+    }
+private:
+    SerializedArray(unsigned length)
+        : m_length(length)
+    {
+    }
+
+    Vector<SerializedScriptValueData> m_compactStorage;
+    SparseMap m_sparseStorage;
+    unsigned m_length;
+};
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
+    : m_type(ObjectType)
+    , m_sharedData(data)
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> data)
+    : m_type(ArrayType)
+    , m_sharedData(data)
+{
+}
+
+SerializedArray* SharedSerializedData::asArray()
+{
+    return static_cast<SerializedArray*>(this);
+}
+
+SerializedObject* SharedSerializedData::asObject()
+{
+    return static_cast<SerializedObject*>(this);
+}
+
+static const unsigned maximumFilterRecursion = 40000;
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
+    ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+template <typename TreeWalker> typename TreeWalker::OutputType walk(TreeWalker& context, typename TreeWalker::InputType in)
+{
+    typedef typename TreeWalker::InputObject InputObject;
+    typedef typename TreeWalker::InputArray InputArray;
+    typedef typename TreeWalker::OutputObject OutputObject;
+    typedef typename TreeWalker::OutputArray OutputArray;
+    typedef typename TreeWalker::InputType InputType;
+    typedef typename TreeWalker::OutputType OutputType;
+    typedef typename TreeWalker::PropertyList PropertyList;
+
+    Vector<uint32_t, 16> indexStack;
+    Vector<uint32_t, 16> lengthStack;
+    Vector<PropertyList, 16> propertyStack;
+    Vector<InputObject, 16> inputObjectStack;
+    Vector<InputArray, 16> inputArrayStack;
+    Vector<OutputObject, 16> outputObjectStack;
+    Vector<OutputArray, 16> outputArrayStack;
+    Vector<WalkerState, 16> stateStack;
+    WalkerState state = StateUnknown;
+    InputType inValue = in;
+    OutputType outValue = context.null();
+
+    unsigned tickCount = context.ticksUntilNextCheck();
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(context.isArray(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+
+                InputArray inArray = context.asInputArray(inValue);
+                unsigned length = context.length(inArray);
+                OutputArray outArray = context.createOutputArray(length);
+                if (!context.startArray(inArray, outArray))
+                    return context.null();
+                inputArrayStack.append(inArray);
+                outputArrayStack.append(outArray);
+                indexStack.append(0);
+                lengthStack.append(length);
+                // fallthrough
+            }
+            arrayStartVisitMember:
+            case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputArray array = inputArrayStack.last();
+                uint32_t index = indexStack.last();
+                if (index == lengthStack.last()) {
+                    InputArray inArray = inputArrayStack.last();
+                    OutputArray outArray = outputArrayStack.last();
+                    context.endArray(inArray, outArray);
+                    outValue = outArray;
+                    inputArrayStack.removeLast();
+                    outputArrayStack.removeLast();
+                    indexStack.removeLast();
+                    lengthStack.removeLast();
+                    break;
+                }
+                if (context.canDoFastRead(array, index))
+                    inValue = context.getIndex(array, index);
+                else {
+                    bool hasIndex = false;
+                    inValue = context.getSparseIndex(array, index, hasIndex);
+                    if (!hasIndex) {
+                        indexStack.last()++;
+                        goto arrayStartVisitMember;
+                    }
+                }
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ArrayEndVisitMember: {
+                OutputArray outArray = outputArrayStack.last();
+                context.putProperty(outArray, indexStack.last(), outValue);
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(context.isObject(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+                InputObject inObject = context.asInputObject(inValue);
+                OutputObject outObject = context.createOutputObject();
+                if (!context.startObject(inObject, outObject))
+                    return context.null();
+                inputObjectStack.append(inObject);
+                outputObjectStack.append(outObject);
+                indexStack.append(0);
+                context.getPropertyNames(inObject, propertyStack);
+                // fallthrough
+            }
+            objectStartVisitMember:
+            case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputObject object = inputObjectStack.last();
+                uint32_t index = indexStack.last();
+                PropertyList& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    InputObject inObject = inputObjectStack.last();
+                    OutputObject outObject = outputObjectStack.last();
+                    context.endObject(inObject, outObject);
+                    outValue = outObject;
+                    inputObjectStack.removeLast();
+                    outputObjectStack.removeLast();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                inValue = context.getProperty(object, properties[index], index);
+
+                if (context.shouldTerminate())
+                    return context.null();
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ObjectEndVisitMember: {
+                context.putProperty(outputObjectStack.last(), propertyStack.last()[indexStack.last()], outValue);
+                if (context.shouldTerminate())
+                    return context.null();
+
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (OutputType transformed = context.convertIfTerminal(inValue)) {
+                    outValue = transformed;
+                    break;
+                }
+                if (context.isArray(inValue))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+
+        state = stateStack.last();
+        stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (context.didTimeOut()) {
+                context.throwInterruptedException();
+                return context.null();
+            }
+            tickCount = context.ticksUntilNextCheck();
+        }
+    }
+    return outValue;
+}
+
+struct BaseWalker {
+    BaseWalker(ExecState* exec)
+        : m_exec(exec)
+        , m_timeoutChecker(exec->globalData().timeoutChecker)
+    {
+        m_timeoutChecker.reset();
+    }
+    ExecState* m_exec;
+    TimeoutChecker m_timeoutChecker;
+    MarkedArgumentBuffer m_gcBuffer;
+
+    bool shouldTerminate()
+    {
+        return m_exec->hadException();
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return m_timeoutChecker.ticksUntilNextCheck();
+    }
+
+    bool didTimeOut()
+    {
+        return m_timeoutChecker.didTimeOut(m_exec);
+    }
+
+    void throwStackOverflow()
+    {
+        m_exec->setException(createStackOverflowError(m_exec));
+    }
+
+    void throwInterruptedException()
+    {
+        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+    }
+};
+
+struct SerializingTreeWalker : public BaseWalker {
+    typedef JSValue InputType;
+    typedef JSArray* InputArray;
+    typedef JSObject* InputObject;
+    typedef SerializedScriptValueData OutputType;
+    typedef RefPtr<SerializedArray> OutputArray;
+    typedef RefPtr<SerializedObject> OutputObject;
+    typedef PropertyNameArray PropertyList;
+
+    SerializingTreeWalker(ExecState* exec)
+        : BaseWalker(exec)
+    {
+    }
+
+    OutputType null() { return SerializedScriptValueData(); }
+
+    bool isArray(JSValue value)
+    {
+        if (!value.isObject())
+            return false;
+        JSObject* object = asObject(value);
+        return isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info);
+    }
+
+    bool isObject(JSValue value)
+    {
+        return value.isObject();
+    }
+
+    JSArray* asInputArray(JSValue value)
+    {
+        return asArray(value);
+    }
+
+    JSObject* asInputObject(JSValue value)
+    {
+        return asObject(value);
+    }
+
+    PassRefPtr<SerializedArray> createOutputArray(unsigned length)
+    {
+        return SerializedArray::create(length);
+    }
+
+    PassRefPtr<SerializedObject> createOutputObject()
+    {
+        return SerializedObject::create();
+    }
+
+    uint32_t length(JSValue array)
+    {
+        ASSERT(array.isObject());
+        JSObject* object = asObject(array);
+        return object->get(m_exec, m_exec->propertyNames().length).toUInt32(m_exec);
+    }
+
+    bool canDoFastRead(JSArray* array, unsigned index)
+    {
+        return isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index);
+    }
+
+    JSValue getIndex(JSArray* array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    JSValue getSparseIndex(JSObject* object, unsigned propertyName, bool& hasIndex)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot)) {
+            hasIndex = true;
+            return slot.getValue(m_exec, propertyName);
+        }
+        hasIndex = false;
+        return jsNull();
+    }
+
+    JSValue getProperty(JSObject* object, const Identifier& propertyName, unsigned)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot))
+            return slot.getValue(m_exec, propertyName);
+        return jsNull();
+    }
+
+    SerializedScriptValueData convertIfTerminal(JSValue value)
+    {
+        if (!value.isCell())
+            return SerializedScriptValueData(value);
+
+        if (value.isString())
+            return SerializedScriptValueData(asString(value)->value());
+
+        if (value.isNumber())
+            return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
+
+        if (value.isObject() && asObject(value)->inherits(&DateInstance::info))
+            return SerializedScriptValueData(SerializedScriptValueData::DateType, asDateInstance(value)->internalNumber());
+
+        if (isArray(value))
+            return SerializedScriptValueData();
+
+        CallData unusedData;
+        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
+            return SerializedScriptValueData();
+
+        // Any other types are expected to serialize as null.
+        return SerializedScriptValueData(jsNull());
+    }
+
+    void getPropertyNames(JSObject* object, Vector<PropertyNameArray, 16>& propertyStack)
+    {
+        propertyStack.append(PropertyNameArray(m_exec));
+        object->getOwnPropertyNames(m_exec, propertyStack.last());
+    }
+
+    void putProperty(RefPtr<SerializedArray> array, unsigned propertyName, const SerializedScriptValueData& value)
+    {
+        array->setIndex(propertyName, value);
+    }
+
+    void putProperty(RefPtr<SerializedObject> object, const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        object->set(propertyName, value);
+    }
+
+    bool startArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inArray).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inArray);
+        return true;
+    }
+
+    void endArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        m_cycleDetector.remove(inArray);
+        m_gcBuffer.removeLast();
+    }
+
+    bool startObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inObject).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inObject);
+        return true;
+    }
+
+    void endObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        m_cycleDetector.remove(inObject);
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    HashSet<JSObject*> m_cycleDetector;
+};
+
+SerializedScriptValueData SerializedScriptValueData::serialize(ExecState* exec, JSValue inValue)
+{
+    SerializingTreeWalker context(exec);
+    return walk<SerializingTreeWalker>(context, inValue);
+}
+
+
+struct DeserializingTreeWalker : public BaseWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef JSValue OutputType;
+    typedef JSArray* OutputArray;
+    typedef JSObject* OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+        : BaseWalker(exec)
+        , m_mustCopy(mustCopy)
+    {
+    }
+
+    OutputType null() { return jsNull(); }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    JSArray* createOutputArray(unsigned length)
+    {
+        JSArray* array = constructEmptyArray(m_exec);
+        array->setLength(length);
+        return array;
+    }
+
+    JSObject* createOutputObject()
+    {
+        return constructEmptyObject(m_exec);
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    JSValue convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return JSValue();
+            case SerializedScriptValueData::StringType:
+                return jsString(m_exec, value.asString().crossThreadString());
+            case SerializedScriptValueData::ImmediateType:
+                return value.asImmediate();
+            case SerializedScriptValueData::NumberType:
+                return jsNumber(m_exec, value.asDouble());
+            case SerializedScriptValueData::DateType:
+                return new (m_exec) DateInstance(m_exec, value.asDouble());
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(JSArray* array, unsigned propertyName, JSValue value)
+    {
+        array->put(m_exec, propertyName, value);
+    }
+
+    void putProperty(JSObject* object, const RefPtr<StringImpl> propertyName, JSValue value)
+    {
+        object->putDirect(Identifier(m_exec, String(propertyName)), value);
+    }
+
+    bool startArray(RefPtr<SerializedArray>, JSArray* outArray)
+    {
+        m_gcBuffer.append(outArray);
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray>, JSArray*)
+    {
+        m_gcBuffer.removeLast();
+    }
+    bool startObject(RefPtr<SerializedObject>, JSObject* outObject)
+    {
+        m_gcBuffer.append(outObject);
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject>, JSObject*)
+    {
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    bool m_mustCopy;
+};
+
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+{
+    DeserializingTreeWalker context(exec, mustCopy);
+    return walk<DeserializingTreeWalker>(context, *this);
+}
+
+struct TeardownTreeWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef bool OutputType;
+    typedef bool OutputArray;
+    typedef bool OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    bool shouldTerminate()
+    {
+        return false;
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return 0xFFFFFFFF;
+    }
+
+    bool didTimeOut()
+    {
+        return false;
+    }
+
+    void throwStackOverflow()
+    {
+    }
+
+    void throwInterruptedException()
+    {
+    }
+
+    bool null() { return false; }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    bool createOutputArray(unsigned)
+    {
+        return false;
+    }
+
+    bool createOutputObject()
+    {
+        return false;
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    bool convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return false;
+            case SerializedScriptValueData::StringType:
+            case SerializedScriptValueData::ImmediateType:
+            case SerializedScriptValueData::NumberType:
+                return true;
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(bool, unsigned, bool)
+    {
+    }
+
+    void putProperty(bool, const RefPtr<StringImpl>&, bool)
+    {
+    }
+
+    bool startArray(RefPtr<SerializedArray>, bool)
+    {
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray> array, bool)
+    {
+        array->clear();
+    }
+    bool startObject(RefPtr<SerializedObject>, bool)
+    {
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject> object, bool)
+    {
+        object->clear();
+    }
+};
+
+void SerializedScriptValueData::tearDownSerializedData()
+{
+    if (m_sharedData && m_sharedData->refCount() > 1)
+        return;
+    TeardownTreeWalker context;
+    walk<TeardownTreeWalker>(context, *this);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
new file mode 100644
index 0000000..f8a126f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+
+namespace WebCore {
+    class SerializedObject;
+    class SerializedArray;
+
+    class SharedSerializedData : public RefCounted<SharedSerializedData> {
+    public:
+        virtual ~SharedSerializedData() { }
+        SerializedArray* asArray();
+        SerializedObject* asObject();
+    };
+
+    class SerializedScriptValue;
+
+    class SerializedScriptValueData {
+    public:
+        enum SerializedType {
+            EmptyType,
+            DateType,
+            NumberType,
+            ImmediateType,
+            ObjectType,
+            ArrayType,
+            StringType
+        };
+
+        SerializedType type() const { return m_type; }
+        static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
+        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+
+        ~SerializedScriptValueData()
+        {
+            if (m_sharedData)
+                tearDownSerializedData();
+        }
+
+        SerializedScriptValueData()
+            : m_type(EmptyType)
+        {
+        }
+
+        explicit SerializedScriptValueData(const String& string)
+            : m_type(StringType)
+            , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
+        {
+        }
+
+        explicit SerializedScriptValueData(JSC::JSValue value)
+            : m_type(ImmediateType)
+        {
+            ASSERT(!value.isCell());
+            m_data.m_immediate = JSC::JSValue::encode(value);
+        }
+
+        SerializedScriptValueData(SerializedType type, double value)
+            : m_type(type)
+        {
+            m_data.m_double = value;
+        }
+
+        SerializedScriptValueData(RefPtr<SerializedObject>);
+        SerializedScriptValueData(RefPtr<SerializedArray>);
+
+        JSC::JSValue asImmediate() const
+        {
+            ASSERT(m_type == ImmediateType);
+            return JSC::JSValue::decode(m_data.m_immediate);
+        }
+
+        double asDouble() const
+        {
+            ASSERT(m_type == NumberType || m_type == DateType);
+            return m_data.m_double;
+        }
+
+        String asString() const
+        {
+            ASSERT(m_type == StringType);
+            return m_string;
+        }
+
+        SerializedObject* asObject() const
+        {
+            ASSERT(m_type == ObjectType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asObject();
+        }
+
+        SerializedArray* asArray() const
+        {
+            ASSERT(m_type == ArrayType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asArray();
+        }
+
+        operator bool() const { return m_type != EmptyType; }
+
+        SerializedScriptValueData release()
+        {
+            SerializedScriptValueData result = *this;
+            *this = SerializedScriptValueData();
+            return result;
+        }
+
+    private:
+        void tearDownSerializedData();
+        SerializedType m_type;
+        RefPtr<SharedSerializedData> m_sharedData;
+        String m_string;
+        union {
+            double m_double;
+            JSC::EncodedJSValue m_immediate;
+        } m_data;
+    };
+
+    class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+    public:
+        static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create(String string)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create()
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData()));
+        }
+
+        PassRefPtr<SerializedScriptValue> release()
+        {
+            PassRefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_value));
+            m_value = SerializedScriptValueData();
+            result->m_mustCopy = true;
+            return result;
+        }
+
+        String toString()
+        {
+            if (m_value.type() != SerializedScriptValueData::StringType)
+                return "";
+            return m_value.asString();
+        }
+
+        JSC::JSValue deserialize(JSC::ExecState* exec)
+        {
+            if (!m_value)
+                return JSC::jsNull();
+            return m_value.deserialize(exec, m_mustCopy);
+        }
+
+        ~SerializedScriptValue() {}
+
+    private:
+        SerializedScriptValue(SerializedScriptValueData value)
+            : m_value(value)
+            , m_mustCopy(false)
+        {
+        }
+
+        SerializedScriptValueData m_value;
+        bool m_mustCopy;
+    };
+}
+
+#endif // SerializedScriptValue_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index 92bd390..c1cb0a0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -59,6 +59,12 @@ my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                            "SVGAnimatedTransformList" => 1);
 
+my %svgAttributesInHTMLHash = ("class" => 1, "id" => 1, "onabort" => 1, "onclick" => 1,
+                               "onerror" => 1, "onload" => 1, "onmousedown" => 1,
+                               "onmousemove" => 1, "onmouseout" => 1, "onmouseover" => 1,
+                               "onmouseup" => 1, "onresize" => 1, "onscroll" => 1,
+                               "onunload" => 1);
+
 # Cache of IDL file pathnames.
 my $idlFiles;
 
@@ -347,4 +353,12 @@ sub WK_lcfirst
     return $ret;
 }
 
+# Return the C++ namespace that a given attribute name string is defined in.
+sub NamespaceForAttributeName
+{
+    my ($object, $interfaceName, $attributeName) = @_;
+    return "SVGNames" if $interfaceName =~ /^SVG/ && !$svgAttributesInHTMLHash{$attributeName};
+    return "HTMLNames";
+}
+
 1;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 4d5cb96..4ca441b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -524,7 +524,7 @@ sub GenerateCPPAttributeSignature
 
 sub GenerateCPPAttribute
 {
-    my ($attribute, $className, $implementationClass) = @_;
+    my ($attribute, $className, $implementationClass, $IDLType) = @_;
 
     my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
 
@@ -598,9 +598,10 @@ sub GenerateCPPAttribute
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $CPPImplementationWebCoreIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
+            my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
+            $CPPImplementationWebCoreIncludes{"${namespace}.h"} = 1;
+            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
         } else {
             push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->${setterName}(" . join(", ", @setterParams) . ");\n");
         }
@@ -620,10 +621,11 @@ sub GenerateCPPAttribute
     my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
     my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
     if ($reflect || $reflectURL) {
-        $implIncludes{"HTMLNames.h"} = 1;
         my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+        my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
+        $implIncludes{"${namespace}.h"} = 1;
         my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr)";
+        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr)";
     } else {
         $implementationGetter = "impl${implementationClassWithoutNamespace}()->" . $codeGenerator->WK_lcfirst($attributeName) . "(" . ($hasGetterException ? "ec" : ""). ")";
     }
@@ -1154,7 +1156,7 @@ sub GenerateCPPImplementation
 
                 AddIncludesForTypeInCPPImplementation($attribute->signature->type);
 
-                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass);
+                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
                 push(@CPPImplementationContent, values(%attributes));
             }
         }
@@ -1182,7 +1184,7 @@ sub GenerateCPPImplementation
 
             AddIncludesForTypeInCPPImplementation($attribute->signature->type);
 
-            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass);
+            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
             push(@CPPImplementationContent, values(%attributes));
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index d552aa0..ff7b52f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -463,6 +463,7 @@ sub GenerateHeader
     my $className = "JS$interfaceName";
     my $implClassName = $interfaceName;
     my @ancestorInterfaceNames = ();
+    my %structureFlags = ();
 
     # We only support multiple parents with SVG (for now).
     if (@{$dataNode->parents} > 1) {
@@ -574,6 +575,7 @@ sub GenerateHeader
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
         push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
+        $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
 
     # Check if we have any writable properties
@@ -602,21 +604,20 @@ sub GenerateHeader
 
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));\n" .
-            "    }\n\n");
-    } elsif ($hasGetter) {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
-            "    }\n\n");
+        $structureFlags{"JSC::ImplementsHasInstance"} = 1;
+        $structureFlags{"JSC::NeedsThisConversion"} = 1;
     }
+    push(@headerContent,
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    {\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "    }\n\n");
 
     # markChildren function
-    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $needsMarkChildren;
+    if ($needsMarkChildren) {
+        push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n");
+        $structureFlags{"JSC::OverridesMarkChildren"} = 1;
+    }
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -628,13 +629,19 @@ sub GenerateHeader
     push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
     # Custom getPropertyNames function exists on DOMWindow
-    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+    if ($interfaceName eq "DOMWindow") {
+        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;
+    }
 
     # Custom defineProperty function exists on DOMWindow
     push(@headerContent, "    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $interfaceName eq "DOMWindow";
 
     # Custom getOwnPropertyNames function
-    push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
+    if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
+    }
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
@@ -712,6 +719,14 @@ sub GenerateHeader
         push(@headerContent, "        return static_cast<$implClassName*>(Base::impl());\n");
         push(@headerContent, "    }\n");
     }
+    
+    # structure flags
+    push(@headerContent, "protected:\n");
+    push(@headerContent, "    static const unsigned StructureFlags = ");
+    foreach my $structureFlag (keys %structureFlags) {
+        push(@headerContent, $structureFlag . " | ");
+    }
+    push(@headerContent, "Base::StructureFlags;\n");
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
@@ -719,6 +734,7 @@ sub GenerateHeader
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
+        
     }
     
     # Index setter
@@ -770,6 +786,7 @@ sub GenerateHeader
     push(@headerContent, "\n");
 
     # Add prototype declaration.
+    %structureFlags = ();
     push(@headerContent, "class ${className}Prototype : public JSC::JSObject {\n");
     push(@headerContent, "    typedef JSC::JSObject Base;\n");
     push(@headerContent, "public:\n");
@@ -787,19 +804,16 @@ sub GenerateHeader
         push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
         push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
-
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($needsMarkChildren ? "" : ", JSC::HasDefaultMark") . "));\n" .
-            "    }\n");
-    } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
-            "    }\n");
+        $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
+    if ($dataNode->extendedAttributes->{"CustomMarkFunction"} or $needsMarkChildren) {
+        $structureFlags{"JSC::OverridesMarkChildren"} = 1;
+    }
+    push(@headerContent,
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    {\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -810,6 +824,14 @@ sub GenerateHeader
 
     push(@headerContent, "    ${className}Prototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
+    # structure flags
+    push(@headerContent, "protected:\n");
+    push(@headerContent, "    static const unsigned StructureFlags = ");
+    foreach my $structureFlag (keys %structureFlags) {
+        push(@headerContent, $structureFlag . " | ");
+    }
+    push(@headerContent, "Base::StructureFlags;\n");
+
     push(@headerContent, "};\n\n");
 
     if ($numFunctions > 0) {
@@ -1323,10 +1345,11 @@ sub GenerateImplementation
                         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
                         if ($reflect || $reflectURL) {
-                            $implIncludes{"HTMLNames.h"} = 1;
                             my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
+                            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                            $implIncludes{"${namespace}.h"} = 1;
                             my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-                            $value = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr)"
+                            $value = "imp->$getAttributeFunctionName(${namespace}::${contentAttributeName}Attr)"
                         } else {
                             $value = "imp->$implGetterFunctionName()";
                         }
@@ -1483,9 +1506,10 @@ sub GenerateImplementation
                                 my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                                 my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
                                 if ($reflect || $reflectURL) {
-                                    $implIncludes{"HTMLNames.h"} = 1;
                                     my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
-                                    push(@implContent, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $nativeValue");
+                                    my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                                    $implIncludes{"${namespace}.h"} = 1;
+                                    push(@implContent, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $nativeValue");
                                 } else {
                                     push(@implContent, "    imp->set$implSetterFunctionName($nativeValue");
                                 }
@@ -1842,6 +1866,11 @@ sub JSValueToNative
         return "$value.toString(exec)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create(exec, $value)";
+    }
+
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
     $implIncludes{"FloatRect.h"} = 1 if $type eq "SVGRect";
     $implIncludes{"HTMLOptionElement.h"} = 1 if $type eq "HTMLOptionElement";
@@ -1928,6 +1957,8 @@ sub NativeToJSValue
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+        $value =~ s/operator\(\)/_operator\(\)/ if ($value =~ /operator/);
         $value =~ s/\(\)//;
         $value .= "Animated()";
     }
@@ -1947,6 +1978,9 @@ sub NativeToJSValue
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
         $implIncludes{"$joinedName.h"} = 1;
+    } elsif ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "$value->deserialize(exec)";
     } else {
         # Default, include header with same name.
         $implIncludes{"JS$type.h"} = 1;
@@ -2241,8 +2275,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 EOF
 
     if ($canConstruct) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 0026ba1..91248c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -311,7 +311,7 @@ sub GetClassName
     my $name = $codeGenerator->StripModule(shift);
 
     # special cases
-    return "NSString" if $codeGenerator->IsStringType($name);
+    return "NSString" if $codeGenerator->IsStringType($name) or $name eq "SerializedScriptValue";
     return "NS$name" if IsNativeObjCType($name);
     return "BOOL" if $name eq "boolean";
     return "unsigned" if $name eq "unsigned long";
@@ -492,6 +492,11 @@ sub GetObjCTypeGetter
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
+    
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "WebCore::SerializedScriptValue::create(WebCore::String($argName))";
+    }
     return "core($argName)";
 }
 
@@ -607,6 +612,11 @@ sub AddIncludesForType
         return;
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return;
+    }
+
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
@@ -715,6 +725,8 @@ sub GenerateHeader
             my $attributeIsReadonly = ($attribute->type =~ /^readonly/);
 
             my $property = "\@property" . GetPropertyAttributes($attribute->signature->type, $attributeIsReadonly);
+            # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+            $attributeName =~ s/operator/_operator/ if ($attributeName =~ /operator/);
             $property .= " " . $attributeType . ($attributeType =~ /\*$/ ? "" : " ") . $attributeName;
 
             my $publicInterfaceKey = $property . ";";
@@ -1139,15 +1151,21 @@ sub GenerateImplementation
 
             # - GETTER
             my $getterSig = "- ($attributeType)$attributeInterfaceName\n";
+
+            # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+            $attributeName =~ s/operatorAnimated/_operatorAnimated/ if ($attributeName =~ /operatorAnimated/);
+            $getterSig =~ s/operator/_operator/ if ($getterSig =~ /operator/);
+
             my $hasGetterException = @{$attribute->getterExceptions};
             my $getterContentHead;
             my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
             my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
             if ($reflect || $reflectURL) {
-                $implIncludes{"HTMLNames.h"} = 1;
                 my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+                my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                $implIncludes{"${namespace}.h"} = 1;
                 my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr";
+                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr";
             } else {
                 $getterContentHead = "IMPL->" . $codeGenerator->WK_lcfirst($attributeName) . "(";
             }
@@ -1212,6 +1230,9 @@ sub GenerateImplementation
             } elsif ($idlType eq "Color") {
                 $getterContentHead = "WebCore::nsColor($getterContentHead";
                 $getterContentTail .= ")";
+            } elsif ($attribute->signature->type eq "SerializedScriptValue") {
+                $getterContentHead = "$getterContentHead";
+                $getterContentTail .= "->toString()";                
             } elsif (ConversionNeeded($attribute->signature->type)) {
                 $getterContentHead = "kit(WTF::getPtr($getterContentHead";
                 $getterContentTail .= "))";
@@ -1278,20 +1299,20 @@ sub GenerateImplementation
                     } else {
                         push(@implContent, "    IMPL->$coreSetterName($arg);\n");
                     }
-                } elsif ($hasSetterException) {
-                    push(@implContent, "    $exceptionInit\n");
-                    push(@implContent, "    IMPL->$coreSetterName($arg, ec);\n");
-                    push(@implContent, "    $exceptionRaiseOnError\n");
                 } else {
                     my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                     my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+                    push(@implContent, "    $exceptionInit\n") if $hasSetterException;
+                    my $ec = $hasSetterException ? ", ec" : "";
                     if ($reflect || $reflectURL) {
-                        $implIncludes{"HTMLNames.h"} = 1;
                         my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-                        push(@implContent, "    IMPL->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, $arg);\n");
+                        my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                        $implIncludes{"${namespace}.h"} = 1;
+                        push(@implContent, "    IMPL->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, $arg$ec);\n");
                     } else {
-                        push(@implContent, "    IMPL->$coreSetterName($arg);\n");
+                        push(@implContent, "    IMPL->$coreSetterName($arg$ec);\n");
                     }
+                    push(@implContent, "    $exceptionRaiseOnError\n") if $hasSetterException;
                 }
 
                 push(@implContent, "}\n\n");
@@ -1446,6 +1467,8 @@ sub GenerateImplementation
                     push(@functionContent, "        return $toReturn;\n");
                     push(@functionContent, "    return nil;\n");
                 }
+            } elsif ($returnType eq "SerializedScriptValue") {
+                $content = "foo";
             } else {
                 if (ConversionNeeded($function->signature->type)) {
                     if ($codeGenerator->IsPodType($function->signature->type)) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 7f1508b..28562f1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -326,10 +326,26 @@ sub IsNodeSubType
     return 0;
 }
 
-sub RequiresCustomEventListenerAccessors
+sub GetHiddenDependencyIndex
 {
     my $dataNode = shift;
-    return !IsNodeSubType($dataNode) && $dataNode->name ne "SVGElementInstance";
+    my $attribute = shift;
+    my $name = $dataNode->name;
+    return "V8Custom::kNodeEventListenerCacheIndex" if IsNodeSubType($dataNode);
+    return "V8Custom::kSVGElementInstanceEventListenerCacheIndex" if $name eq "SVGElementInstance";
+    return "V8Custom::kAbstractWorkerRequestCacheIndex" if $name eq "AbstractWorker";
+    return "V8Custom::kWorkerRequestCacheIndex" if $name eq "Worker";
+    return "V8Custom::kDedicatedWorkerContextRequestCacheIndex" if $name eq "DedicatedWorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "WorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "SharedWorkerContext";
+    return "V8Custom::kMessagePortRequestCacheIndex" if $name eq "MessagePort";
+    return "V8Custom::kWebSocketCacheIndex" if $name eq "WebSocket";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequest";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequestUpload";
+    return "V8Custom::kDOMApplicationCacheCacheIndex" if $name eq "DOMApplicationCache";
+    return "V8Custom::kNotificationRequestCacheIndex" if $name eq "Notification";
+    return "V8Custom::kDOMWindowEventListenerCacheIndex" if $name eq "DOMWindow";
+    die "Unexpected name " . $name . " when generating " . $attribute;
 }
 
 sub HolderToNative
@@ -444,6 +460,7 @@ sub GenerateNormalAttrGetter
     my $dataNode = shift;
     my $classIndex = shift;
     my $implClassName = shift;
+    my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -500,11 +517,17 @@ END
         }
 
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -540,10 +563,11 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
             my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-            $getterString = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr";
+            $getterString = "imp->$getAttributeFunctionName(${namespace}::${contentAttributeName}Attr";
         } else {
             $getterString = "imp->$getterFunc(";
         }
@@ -594,6 +618,10 @@ END
         }
 
     } else {
+        if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return v8::Undefined();\n");
+        }
         push(@implContentDecls, "    $nativeType v = ");
 
         push(@implContentDecls, "$getterString;\n");
@@ -651,6 +679,7 @@ sub GenerateNormalAttrSetter
     my $dataNode = shift;
     my $classIndex = shift;
     my $implClassName = shift;
+    my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -672,11 +701,17 @@ sub GenerateNormalAttrSetter
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    if (holder.IsEmpty()) return;
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -687,7 +722,11 @@ END
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
     if ($attribute->signature->type eq "EventListener") {
-        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, false);\n");
+        if ($dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return;\n");
+        }
+        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
     } else {
         push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
     }
@@ -719,20 +758,24 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
-            push(@implContentDecls, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $result");
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $result");
         } elsif ($attribute->signature->type eq "EventListener") {
             $implIncludes{"V8AbstractEventListener.h"} = 1;
             $implIncludes{"V8CustomBinding.h"} = 1;
+            $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
             push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
-            push(@implContentDecls, "    if (old && static_cast<V8AbstractEventListener*>(old.get())->isObjectListener()) {\n");
-            push(@implContentDecls, "      v8::Local<v8::Object> oldListener = static_cast<V8AbstractEventListener*>(old.get())->getListenerObject();\n");
-            push(@implContentDecls, "      removeHiddenDependency(holder, oldListener, V8Custom::kNodeEventListenerCacheIndex);\n");
+            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
+            push(@implContentDecls, "    if (oldListener) {\n");
+            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
+            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
+            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
             push(@implContentDecls, "    }\n");
             push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
             push(@implContentDecls, "    if ($result)\n");
-            push(@implContentDecls, "      createHiddenDependency(holder, value, V8Custom::kNodeEventListenerCacheIndex");
+            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
         } else {
             push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
         }
@@ -905,142 +948,134 @@ sub GenerateBatchedAttributeData
     my $attributes = shift;
 
     foreach my $attribute (@$attributes) {
-        my $attrName = $attribute->signature->name;
-        my $attrExt = $attribute->signature->extendedAttributes;
-
-        my $accessControl = "v8::DEFAULT";
-        if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
-            $accessControl = "v8::ALL_CAN_READ";
-        } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
-            $accessControl = "v8::ALL_CAN_WRITE";
-        } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
-            $accessControl = "v8::ALL_CAN_READ";
-            if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
-                $accessControl .= "|v8::ALL_CAN_WRITE";
-            }
-        }
-        if ($attrExt->{"V8DisallowShadowing"}) {
-            $accessControl .= "|v8::PROHIBITS_OVERWRITING";
-        }
-        $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
-
-        my $customAccessor =
-            $attrExt->{"Custom"} ||
-            $attrExt->{"CustomSetter"} ||
-            $attrExt->{"CustomGetter"} ||
-            $attrExt->{"V8Custom"} ||
-            $attrExt->{"V8CustomSetter"} ||
-            $attrExt->{"V8CustomGetter"} ||
-            "";
-        if ($customAccessor eq 1) {
-            # use the naming convension, interface + (capitalize) attr name
-            $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
-        }
+        my $conditionalString = GenerateConditionalString($attribute->signature);
+        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+        GenerateSingleBatchedAttribute($interfaceName, $attribute, ",", "");
+        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    }
+}
 
-        my $getter;
-        my $setter;
-        my $propAttr = "v8::None";
-        my $hasCustomSetter = 0;
+sub GenerateSingleBatchedAttribute
+{
+    my $interfaceName = shift;
+    my $attribute = shift;
+    my $delimiter = shift;
+    my $indent = shift;
+    my $attrName = $attribute->signature->name;
+    my $attrExt = $attribute->signature->extendedAttributes;
 
-        # Check attributes.
-        if ($attrExt->{"DontEnum"}) {
-            $propAttr .= "|v8::DontEnum";
-        }
-        if ($attrExt->{"V8DisallowShadowing"}) {
-            $propAttr .= "|v8::DontDelete";
+    my $accessControl = "v8::DEFAULT";
+    if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
+        $accessControl = "v8::ALL_CAN_READ";
+    } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
+        $accessControl = "v8::ALL_CAN_WRITE";
+    } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
+        $accessControl = "v8::ALL_CAN_READ";
+        if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
+            $accessControl .= "|v8::ALL_CAN_WRITE";
         }
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $accessControl .= "|v8::PROHIBITS_OVERWRITING";
+    }
+    $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
+
+    my $customAccessor =
+        $attrExt->{"Custom"} ||
+        $attrExt->{"CustomSetter"} ||
+        $attrExt->{"CustomGetter"} ||
+        $attrExt->{"V8Custom"} ||
+        $attrExt->{"V8CustomSetter"} ||
+        $attrExt->{"V8CustomGetter"} ||
+        "";
+    if ($customAccessor eq 1) {
+        # use the naming convension, interface + (capitalize) attr name
+        $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
+    }
 
-        my $on_proto = "0 /* on instance */";
-        my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+    my $getter;
+    my $setter;
+    my $propAttr = "v8::None";
+    my $hasCustomSetter = 0;
 
-        # Constructor
-        if ($attribute->signature->type =~ /Constructor$/) {
-            my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
-            $constructorType =~ s/Constructor$//;
-            my $constructorIndex = uc($constructorType);
+    # Check attributes.
+    if ($attrExt->{"DontEnum"}) {
+        $propAttr .= "|v8::DontEnum";
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $propAttr .= "|v8::DontDelete";
+    }
+
+    my $on_proto = "0 /* on instance */";
+    my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+
+    # Constructor
+    if ($attribute->signature->type =~ /Constructor$/) {
+        my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
+        $constructorType =~ s/Constructor$//;
+        my $constructorIndex = uc($constructorType);
+        if ($customAccessor) {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        } else {
             $data = "V8ClassIndex::${constructorIndex}";
             $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
-            $setter = "0";
-            $propAttr = "v8::ReadOnly";
-
-        # EventListeners
-        } elsif ($attribute->signature->type eq "EventListener" && RequiresCustomEventListenerAccessors($dataNode)) {
-            if ($interfaceName eq "DOMWindow") {
-                $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "DOMApplicationCache") {
-                $getter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "Notification") {
-                $getter = "V8Custom::v8NotificationEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8NotificationEventHandlerAccessorSetter";
-            } else {
-                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-                if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                    $setter = "0";
-                    $propAttr = "v8::ReadOnly";
-                } else {
-                    $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-                }
-            }
-        } else {
-            # Default Getter and Setter
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
-
-            # Custom Setter
-            if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-                $hasCustomSetter = 1;
-                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-            }
-
-            # Custom Getter
-            if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            }
         }
+        $setter = "0";
+        $propAttr = "v8::ReadOnly";
 
-        # Replaceable
-        if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
-            $setter = "0";
-            # Handle the special case of window.top being marked as Replaceable.
-            # FIXME: Investigate whether we could treat window.top as replaceable 
-            # and allow shadowing without it being a security hole.
-            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) { 
-                $propAttr .= "|v8::ReadOnly";
-            }
+    } else {
+        # Default Getter and Setter
+        $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+        $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+
+        # Custom Setter
+        if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $hasCustomSetter = 1;
+            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
         }
 
-        # Read only attributes
-        if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
-            $setter = "0";
+        # Custom Getter
+        if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
         }
+    }
 
-        # An accessor can be installed on the proto
-        if ($attrExt->{"v8OnProto"}) {
-            $on_proto = "1 /* on proto */";
+    # Replaceable
+    if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
+        $setter = "0";
+        # Handle the special case of window.top being marked as Replaceable.
+        # FIXME: Investigate whether we could treat window.top as replaceable
+        # and allow shadowing without it being a security hole.
+        if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
+            $propAttr .= "|v8::ReadOnly";
         }
+    }
 
-        my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
-                          "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
-        
-        my $conditionalString = GenerateConditionalString($attribute->signature);
-        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+    # Read only attributes
+    if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
+        $setter = "0";
+    }
 
-        push(@implContent, <<END);
-  // $commentInfo
-  { "$attrName",
-    $getter,
-    $setter,
-    $data,
-    $accessControl,
-    static_cast<v8::PropertyAttribute>($propAttr),
-    $on_proto },
-END
-        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    # An accessor can be installed on the proto
+    if ($attrExt->{"v8OnProto"}) {
+        $on_proto = "1 /* on proto */";
     }
-}
 
+    my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
+                      "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
+
+    push(@implContent, $indent . "    {\n");
+    push(@implContent, $indent . "        \/\/ $commentInfo\n");
+    push(@implContent, $indent . "        \"$attrName\",\n");
+    push(@implContent, $indent . "        $getter,\n");
+    push(@implContent, $indent . "        $setter,\n");
+    push(@implContent, $indent . "        $data,\n");
+    push(@implContent, $indent . "        $accessControl,\n");
+    push(@implContent, $indent . "        static_cast<v8::PropertyAttribute>($propAttr),\n");
+    push(@implContent, $indent . "        $on_proto\n");
+    push(@implContent, $indent . "    }" . $delimiter . "\n");
+END
+}
 
 sub GenerateImplementation
 {
@@ -1088,20 +1123,16 @@ sub GenerateImplementation
 
         # Generate special code for the constructor attributes.
         if ($attrType =~ /Constructor$/) {
-            $hasConstructors = 1;
+            if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                $implIncludes{"V8CustomBinding.h"} = 1;
+            } else {
+                $hasConstructors = 1;
+            }
             next;
         }
 
-        # Make EventListeners custom for some types.
-        # FIXME: make the perl code capable of generating the
-        #   event setters/getters.  For now, WebKit has started removing the
-        #   [Custom] attribute, so just automatically insert it to avoid forking
-        #   other files.  This should be okay because we can't generate stubs
-        #   for any event getter/setters anyway.
-        if ($attrType eq "EventListener" && RequiresCustomEventListenerAccessors($dataNode)) {
-            $attribute->signature->extendedAttributes->{"Custom"} = 1;
-            $implIncludes{"V8CustomBinding.h"} = 1;
-            next;
+        if ($attrType eq "EventListener" && $interfaceName eq "DOMWindow") {
+            $attribute->signature->extendedAttributes->{"v8OnProto"} = 1;
         }
 
         # Do not generate accessor if this is a custom attribute.  The
@@ -1117,7 +1148,7 @@ sub GenerateImplementation
         if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
             $implIncludes{"V8CustomBinding.h"} = 1;
         } else {
-            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName);
+            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
         }
         if ($attribute->signature->extendedAttributes->{"CustomSetter"} ||
             $attribute->signature->extendedAttributes->{"V8CustomSetter"}) {
@@ -1126,7 +1157,7 @@ sub GenerateImplementation
             $dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"} || die "Replaceable attribute can only be used in interface that defines ExtendsDOMGlobalObject attribute!";
             # GenerateReplaceableAttrSetter($implClassName);
         } elsif ($attribute->type !~ /^readonly/ && !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
-            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName);
+            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
         }
     }
 
@@ -1157,20 +1188,24 @@ sub GenerateImplementation
 
     # For the DOMWindow interface we partition the attributes into the
     # ones that disallows shadowing and the rest.
-    my @disallows_shadowing;
+    my @disallowsShadowing;
+    # Also separate out attributes that are enabled at runtime so we can process them specially.
+    my @enabledAtRuntime;
     my @normal;
-    if ($interfaceName eq "DOMWindow") {
-        foreach my $attribute (@$attributes) {
-            if ($attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
-                push(@disallows_shadowing, $attribute);
-            } else {
-                push(@normal, $attribute);
-            }
+    foreach my $attribute (@$attributes) {
+        if ($interfaceName eq "DOMWindow" && $attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
+            push(@disallowsShadowing, $attribute);
+        } elsif ($attribute->signature->extendedAttributes->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $attribute);
+        } else {
+            push(@normal, $attribute);
         }
-        # Put the attributes that disallow shadowing on the shadow object.
-        $attributes = \@normal;
+    }
+    $attributes = \@normal;
+    # Put the attributes that disallow shadowing on the shadow object.
+    if (@disallowsShadowing) {
         push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
-        GenerateBatchedAttributeData($dataNode, \@disallows_shadowing);
+        GenerateBatchedAttributeData($dataNode, \@disallowsShadowing);
         push(@implContent, "};\n");
     }
 
@@ -1252,6 +1287,21 @@ END
 END
     }
 
+    # Setup the enable-at-runtime attrs if we have them
+    foreach my $runtime_attr (@enabledAtRuntime) {
+        $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
+        my $conditionalString = GenerateConditionalString($runtime_attr->signature);
+        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+        push(@implContent, "    if (V8Custom::v8${enable_function}Enabled()) {\n");
+        push(@implContent, "        static const BatchedAttribute attrData =\\\n");
+        GenerateSingleBatchedAttribute($interfaceName, $runtime_attr, ";", "    ");
+        push(@implContent, <<END);
+        configureAttribute(instance, proto, attrData);
+    }
+END
+        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    }
+
     # Define our functions with Set() or SetAccessor()
     foreach my $function (@{$dataNode->functions}) {
         my $attrExt = $function->signature->extendedAttributes;
@@ -1456,7 +1506,7 @@ sub GenerateFunctionCallString()
             $paramName = "SVGPODListItem<" . GetNativeType($paramType, 1) . ">::copy($paramName)";
         }
 
-        if ($parameter->type eq "NodeFilter") {
+        if ($parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
             $functionString .= "$paramName.get()";
         } else {
             $functionString .= $paramName;
@@ -1601,6 +1651,7 @@ sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasActiveInfo";
     return 1 if $type eq "CanvasArray";
     return 1 if $type eq "CanvasArrayBuffer";
     return 1 if $type eq "CanvasBooleanArray";
@@ -1738,6 +1789,9 @@ sub GetNativeType
     # temporary hack
     return "RefPtr<NodeFilter>" if $type eq "NodeFilter";
 
+    # necessary as resolvers could be constructed on fly.
+    return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";
+
     return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;
 
     # Default, assume native type is a pointer with same type name as idl type
@@ -1873,6 +1927,11 @@ sub JSValueToNative
         return "toWebCoreString($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create($value)";
+    }
+
     if ($type eq "NodeFilter") {
         return "V8DOMWrapper::wrapNativeNodeFilter($value)";
     }
@@ -1894,6 +1953,10 @@ sub JSValueToNative
         return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
+    if ($type eq "XPathNSResolver") {
+        return "V8DOMWrapper::getXPathNSResolver($value)";
+    }
+
     AddIncludesForType($type);
     # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
 
@@ -1945,10 +2008,16 @@ sub CreateCustomSignature
         if ($first) { $first = 0; }
         else { $result .= ", "; }
         if (IsWrapperType($parameter->type)) {
-            my $type = $parameter->type;
-            my $header = GetV8HeaderName($type);
-            $implIncludes{$header} = 1;
-            $result .= "V8${type}::GetRawTemplate()";
+            if ($parameter->type eq "XPathNSResolver") {
+                # Special case for XPathNSResolver.  All other browsers accepts a callable,
+                # so, even though it's against IDL, accept objects here.
+                $result .= "v8::Handle<v8::FunctionTemplate>()";
+            } else {
+                my $type = $parameter->type;
+                my $header = GetV8HeaderName($type);
+                $implIncludes{$header} = 1;
+                $result .= "V8${type}::GetRawTemplate()";
+            }
         } else {
             $result .= "v8::Handle<v8::FunctionTemplate>()";
         }
@@ -2053,7 +2122,9 @@ sub ReturnNativeToJSValue
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
-    return "return v8::Integer::New($value)" if GetNativeType($type) eq "int";
+    my $nativeType = GetNativeType($type);
+    return "return v8::Integer::New($value)" if $nativeType eq "int";
+    return "return v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
 
     return "return v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
 
@@ -2091,6 +2162,11 @@ sub ReturnNativeToJSValue
         return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "return v8String($value->toString())";
+    }
+
     if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
index 8e0e0d9..8128bf8 100644
--- a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
@@ -27,11 +27,12 @@
 #define IdentifierRep_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <string.h>
 
 namespace WebCore {
     
-class IdentifierRep {
+class IdentifierRep : public FastAllocBase {
 public:
     static IdentifierRep* get(int);
     static IdentifierRep* get(const char*);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index fcdd166..77b5966 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -121,15 +121,19 @@ JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, c
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
 
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -153,14 +157,18 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -188,14 +196,18 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index 07121b0..d57b76d 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -106,6 +106,11 @@
     #include <stdio.h>
 #endif
 
+#if defined(XP_SYMBIAN)
+    #include <QEvent>
+    #include <QRegion>
+#endif
+
 #ifdef XP_WIN
     #include <windows.h>
 #endif
@@ -526,9 +531,9 @@ typedef struct _NPWindow
     uint32    height;
     NPRect    clipRect;    /* Clipping rectangle in port coordinates */
                         /* Used by MAC only.              */
-#ifdef XP_UNIX
+#if defined(XP_UNIX) || defined(XP_SYMBIAN)
     void *    ws_info;    /* Platform-dependent additonal data */
-#endif /* XP_UNIX */
+#endif /* XP_UNIX || XP_SYMBIAN */
     NPWindowType type;    /* Is this a window or a drawable? */
 } NPWindow;
 
@@ -578,6 +583,8 @@ typedef enum {
 typedef EventRecord    NPEvent;
 #endif
 
+#elif defined(XP_SYMBIAN)
+typedef QEvent NPEvent;
 #elif defined(XP_WIN)
 typedef struct _NPEvent
 {
@@ -608,6 +615,8 @@ typedef CGPathRef NPCGRegion;
 typedef HRGN NPRegion;
 #elif defined(XP_UNIX)
 typedef Region NPRegion;
+#elif defined(XP_SYMBIAN)
+typedef QRegion* NPRegion;
 #else
 typedef void *NPRegion;
 #endif /* XP_MAC */
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index edb577c..f2ce954 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -151,7 +151,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
     }
 
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index f614f7f..1218b8c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -59,10 +59,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index 3233ffa..9676048 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -47,10 +47,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | InternalFunction::StructureFlags;
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index f16778e..391e078 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -62,10 +62,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
     RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
index eacbb57..fdd73c4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
@@ -31,8 +31,10 @@
 #endif
 #include <runtime/Protect.h>
 
+#include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace JSC {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index 2935c31..4e067ce 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -77,7 +77,6 @@ static const int computedProperties[] = {
     CSSPropertyBorderTopStyle,
     CSSPropertyBorderTopWidth,
     CSSPropertyBottom,
-    CSSPropertyBoxShadow,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
     CSSPropertyClip,
@@ -129,6 +128,7 @@ static const int computedProperties[] = {
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
     CSSPropertyTextIndent,
+    CSSPropertyTextRendering,
     CSSPropertyTextShadow,
     CSSPropertyTextOverflow,
     CSSPropertyTextTransform,
@@ -170,6 +170,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxOrient,
     CSSPropertyWebkitBoxPack,
     CSSPropertyWebkitBoxReflect,
+    CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
@@ -252,7 +253,6 @@ static const int computedProperties[] = {
     CSSPropertyStrokeMiterlimit,
     CSSPropertyStrokeOpacity,
     CSSPropertyStrokeWidth,
-    CSSPropertyTextRendering,
     CSSPropertyAlignmentBaseline,
     CSSPropertyBaselineShift,
     CSSPropertyDominantBaseline,
@@ -637,6 +637,15 @@ static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepea
     return list.release();
 }
 
+static void logUnimplementedPropertyID(int propertyID)
+{
+    DEFINE_STATIC_LOCAL(HashSet<int>, propertyIDSet, ());
+    if (!propertyIDSet.add(propertyID).second)
+        return;
+
+    LOG_ERROR("WebKit does not yet implement getComputedStyle for '%s'.", getPropertyName(static_cast<CSSPropertyID>(propertyID)));
+} 
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -767,7 +776,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         }
         case CSSPropertyWebkitBoxReflect:
             return valueForReflection(style->boxReflect());
-        case CSSPropertyBoxShadow:
+        case CSSPropertyWebkitBoxShadow:
             return valueForShadow(style->boxShadow(), static_cast<CSSPropertyID>(propertyID));
         case CSSPropertyCaptionSide:
             return CSSPrimitiveValue::create(style->captionSide());
@@ -897,7 +906,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 // for how high to be in pixels does include things like minimum font size and the zoom factor.
                 // On the other hand, since font-size doesn't include the zoom factor, we really can't do
                 // that here either.
-                return CSSPrimitiveValue::create(static_cast<int>(length.percent() * style->fontDescription().specifiedSize()) / 100, CSSPrimitiveValue::CSS_PX);
+                // The line height returned is rounded to the nearest integer.
+                return CSSPrimitiveValue::create(length.calcMinValue(style->fontDescription().specifiedSize(), true), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(length.value(), CSSPrimitiveValue::CSS_PX);
         }
         case CSSPropertyListStyleImage:
@@ -1052,6 +1062,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
             return valueForShadow(style->textShadow(), static_cast<CSSPropertyID>(propertyID));
+        case CSSPropertyTextRendering:
+            return CSSPrimitiveValue::create(style->fontDescription().textRenderingMode());
         case CSSPropertyTextOverflow:
             if (style->textOverflow())
                 return CSSPrimitiveValue::createIdentifier(CSSValueEllipsis);
@@ -1413,7 +1425,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
 #endif
     }
 
-    LOG_ERROR("unimplemented propertyID: %d", propertyID);
+    logUnimplementedPropertyID(propertyID);
     return 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 1c1f7b4..0530e91 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 50
+%expect 51
 
 %nonassoc LOWEST_PREC
 
@@ -268,7 +268,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index c46bf36..10949dd 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -405,9 +405,6 @@ Document* CSSParser::document() const
 
 bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, bool strict)
 {
-    if (unitflags & FNonNeg && value->fValue < 0)
-        return false;
-
     bool b = false;
     switch (value->unit) {
     case CSSPrimitiveValue::CSS_NUMBER:
@@ -451,6 +448,8 @@ bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, bool strict)
     default:
         break;
     }
+    if (b && unitflags & FNonNeg && value->fValue < 0)
+        b = false;
     return b;
 }
 
@@ -894,6 +893,13 @@ bool CSSParser::parseValue(int propId, bool important)
         int propId1, propId2;
         bool result = false;
         if (parseFillProperty(propId, propId1, propId2, val1, val2)) {
+            OwnPtr<ShorthandScope> shorthandScope;
+            if (propId == CSSPropertyBackgroundPosition ||
+                propId == CSSPropertyBackgroundRepeat ||
+                propId == CSSPropertyWebkitMaskPosition ||
+                propId == CSSPropertyWebkitMaskRepeat) {
+                shorthandScope.set(new ShorthandScope(this, propId));
+            }
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
@@ -1190,7 +1196,7 @@ bool CSSParser::parseValue(int propId, bool important)
         valid_primitive = validUnit(value, FLength, m_strict);
         break;
     case CSSPropertyTextShadow: // CSS2 property, dropped in CSS2.1, back in CSS3, so treat as CSS3
-    case CSSPropertyBoxShadow:
+    case CSSPropertyWebkitBoxShadow:
         if (id == CSSValueNone)
             valid_primitive = true;
         else
@@ -1433,6 +1439,11 @@ bool CSSParser::parseValue(int propId, bool important)
             id == CSSValueWave)
             valid_primitive = true;
         break;
+    case CSSPropertyTextRendering: // auto | optimizeSpeed | optimizeLegibility | geometricPrecision
+        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility
+            || id == CSSValueGeometricprecision)
+            valid_primitive = true;
+        break;
     case CSSPropertyTextLineThroughWidth:
     case CSSPropertyTextOverlineWidth:
     case CSSPropertyTextUnderlineWidth:
@@ -3605,7 +3616,7 @@ struct ShadowParseContext {
         , allowBlur(false)
         , allowSpread(false)
         , allowColor(true)
-        , allowStyle(prop == CSSPropertyBoxShadow)
+        , allowStyle(prop == CSSPropertyWebkitBoxShadow)
         , allowBreak(true)
     {
     }
@@ -3637,7 +3648,7 @@ struct ShadowParseContext {
         allowY = false;
         allowBlur = false;
         allowSpread = false;
-        allowStyle = property == CSSPropertyBoxShadow;
+        allowStyle = property == CSSPropertyWebkitBoxShadow;
     }
 
     void commitLength(CSSParserValue* v)
@@ -3656,12 +3667,12 @@ struct ShadowParseContext {
             allowY = false;
             allowBlur = true;
             allowColor = true;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
             allowBreak = true;
         } else if (allowBlur) {
             blur = val.release();
             allowBlur = false;
-            allowSpread = property == CSSPropertyBoxShadow;
+            allowSpread = property == CSSPropertyWebkitBoxShadow;
         } else if (allowSpread) {
             spread = val.release();
             allowSpread = false;
@@ -3678,7 +3689,7 @@ struct ShadowParseContext {
         } else {
             allowBlur = false;
             allowSpread = false;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
         }
     }
 
@@ -5171,11 +5182,6 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const opacity = "opacity";
                 name = opacity;
                 length = strlen(opacity);
-            } else if (strcmp(buffer, "-webkit-box-shadow") == 0) {
-                // CSS Backgrounds/Borders.  -webkit-box-shadow worked in Safari 4 and earlier.
-                const char* const boxShadow = "box-shadow";
-                name = boxShadow;
-                length = strlen(boxShadow);
             } else if (strcmp(buffer, "-webkit-background-size") == 0) {
                 // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
                 const char* const backgroundSize = "background-size";
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
index 24bd9b7..242cda8 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
@@ -60,7 +60,7 @@ struct CSSParserValue {
     PassRefPtr<CSSValue> createCSSValue();
 };
 
-class CSSParserValueList {
+class CSSParserValueList : public FastAllocBase {
 public:
     CSSParserValueList()
         : m_current(0)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index 1f2c9ca..d2286bb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -34,6 +34,8 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -684,6 +686,71 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
+static void appendCSSDouble(Vector<UChar>& vector, double value)
+{
+    // From the CSS specification section titled "Integers and real numbers",
+    // real numbers are only formatted as [sign] [digits] "." [digits].
+    // This differs from printf-style formatting in that exponents (e.g. 1.3e06)
+    // are not allowed.  Since NaN/inf are also not valid CSS values this
+    // function doesn't handle them.
+
+    // For compatibility with what was returned by older versions of
+    // WebKit, we target 6 digits of precision.
+    const int digitsAfterDecimalPoint = 6;
+    long long rounded = llround(fabs(value) * 1000000.0);
+    if (rounded == 0) {
+        vector.append('0');
+        return;
+    }
+
+    char buf[24];
+    int length = snprintf(buf, sizeof(buf), "%lld", rounded);
+    int decimalPoint = length - digitsAfterDecimalPoint;
+
+    // We are matching printf("%g")'s behavior and must trim trailing zeros,
+    // regardless of whether they're significant.
+    while (length > 0 && length > decimalPoint && buf[length - 1] == '0')
+        length--;
+
+    // Reserve an estimate of space for the number of digits we anticipate
+    // along with a minus sign/initial zero/decimal point.
+    vector.reserveCapacity(vector.size() + 3 + length);
+
+    if (value < 0)
+        vector.append('-');
+
+    if (decimalPoint <= 0) {
+        // Only digits after the decimal point.
+        vector.append('0');
+        vector.append('.');
+        for (int i = decimalPoint; i < 0; i++)
+            vector.append('0');
+        for (int i = 0; i < length; i++)
+            vector.append(buf[i]);
+    } else if (length <= decimalPoint) {
+        // Only digits before the decimal point.
+        for (int i = 0; i < length; i++)
+            vector.append(buf[i]);
+    } else {
+        // Digits before and after the decimal point.
+        for (int i = 0; i < decimalPoint; i++)
+            vector.append(buf[i]);
+        vector.append('.');
+        for (int i = decimalPoint; i < length; i++)
+            vector.append(buf[i]);
+    }
+}
+
+static String formatWithUnits(double value, const char* units)
+{
+    Vector<UChar> result;
+    appendCSSDouble(result, value);
+    result.reserveCapacity(result.size() + strlen(units));
+    for (int i = 0; units[i]; i++)
+        result.append(units[i]);
+    return String::adopt(result);
+}
+
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -695,61 +762,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = String::number(m_value.num);
+            text = formatWithUnits(m_value.num, "");
             break;
         case CSS_PERCENTAGE:
-            text = String::format("%.6lg%%", m_value.num);
+            text = formatWithUnits(m_value.num, "%");
             break;
         case CSS_EMS:
-            text = String::format("%.6lgem", m_value.num);
+            text = formatWithUnits(m_value.num, "em");
             break;
         case CSS_EXS:
-            text = String::format("%.6lgex", m_value.num);
+            text = formatWithUnits(m_value.num, "ex");
             break;
         case CSS_REMS:
-            text = String::format("%.6lgrem", m_value.num);
+            text = formatWithUnits(m_value.num, "rem");
             break;
         case CSS_PX:
-            text = String::format("%.6lgpx", m_value.num);
+            text = formatWithUnits(m_value.num, "px");
             break;
         case CSS_CM:
-            text = String::format("%.6lgcm", m_value.num);
+            text = formatWithUnits(m_value.num, "cm");
             break;
         case CSS_MM:
-            text = String::format("%.6lgmm", m_value.num);
+            text = formatWithUnits(m_value.num, "mm");
             break;
         case CSS_IN:
-            text = String::format("%.6lgin", m_value.num);
+            text = formatWithUnits(m_value.num, "in");
             break;
         case CSS_PT:
-            text = String::format("%.6lgpt", m_value.num);
+            text = formatWithUnits(m_value.num, "pt");
             break;
         case CSS_PC:
-            text = String::format("%.6lgpc", m_value.num);
+            text = formatWithUnits(m_value.num, "pc");
             break;
         case CSS_DEG:
-            text = String::format("%.6lgdeg", m_value.num);
+            text = formatWithUnits(m_value.num, "deg");
             break;
         case CSS_RAD:
-            text = String::format("%.6lgrad", m_value.num);
+            text = formatWithUnits(m_value.num, "rad");
             break;
         case CSS_GRAD:
-            text = String::format("%.6lggrad", m_value.num);
+            text = formatWithUnits(m_value.num, "grad");
             break;
         case CSS_MS:
-            text = String::format("%.6lgms", m_value.num);
+            text = formatWithUnits(m_value.num, "ms");
             break;
         case CSS_S:
-            text = String::format("%.6lgs", m_value.num);
+            text = formatWithUnits(m_value.num, "s");
             break;
         case CSS_HZ:
-            text = String::format("%.6lghz", m_value.num);
+            text = formatWithUnits(m_value.num, "hz");
             break;
         case CSS_KHZ:
-            text = String::format("%.6lgkhz", m_value.num);
+            text = formatWithUnits(m_value.num, "khz");
             break;
         case CSS_TURN:
-            text = String::format("%.6lgturn", m_value.num);
+            text = formatWithUnits(m_value.num, "turn");
             break;
         case CSS_DIMENSION:
             // FIXME
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index b46322d..3616aa5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -36,6 +36,7 @@
 #include "RenderStyleConstants.h"
 #include "SVGRenderStyleDefs.h"
 #include "TextDirection.h"
+#include "TextRenderingMode.h"
 #include "ThemeTypes.h"
 
 namespace WebCore {
@@ -199,6 +200,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            m_value.ident = CSSValueListButton;
+            break;
+#endif
         case ListItemPart:
             m_value.ident = CSSValueListitem;
             break;
@@ -1838,6 +1844,42 @@ template<> inline CSSPrimitiveValue::operator FontSmoothingMode() const
     return AutoSmoothing;
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(TextRenderingMode e)
+    : m_type(CSS_IDENT)
+{
+    switch (e) {
+        case AutoTextRendering:
+            m_value.ident = CSSValueAuto;
+            break;
+        case OptimizeSpeed:
+            m_value.ident = CSSValueOptimizespeed;
+            break;
+        case OptimizeLegibility:
+            m_value.ident = CSSValueOptimizelegibility;
+            break;
+        case GeometricPrecision:
+            m_value.ident = CSSValueGeometricprecision;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
+{
+    switch (m_value.ident) {
+        case CSSValueAuto:
+            return AutoTextRendering;
+        case CSSValueOptimizespeed:
+            return OptimizeSpeed;
+        case CSSValueOptimizelegibility:
+            return OptimizeLegibility;
+        case CSSValueGeometricprecision:
+            return GeometricPrecision;
+        default:
+            ASSERT_NOT_REACHED();
+            return AutoTextRendering;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
@@ -2241,42 +2283,6 @@ template<> inline CSSPrimitiveValue::operator ETextAnchor() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ETextRendering e)
-    : m_type(CSS_IDENT)
-{
-    switch (e) {
-        case TR_AUTO:
-            m_value.ident = CSSValueAuto;
-            break;
-        case TR_OPTIMIZESPEED:
-            m_value.ident = CSSValueOptimizespeed;
-            break;
-        case TR_OPTIMIZELEGIBILITY:
-            m_value.ident = CSSValueOptimizelegibility;
-            break;
-        case TR_GEOMETRICPRECISION:
-            m_value.ident = CSSValueGeometricprecision;
-            break;
-    }
-}
-
-template<> inline CSSPrimitiveValue::operator ETextRendering() const
-{
-    switch (m_value.ident) {
-        case CSSValueAuto:
-            return TR_AUTO;
-        case CSSValueOptimizespeed:
-            return TR_OPTIMIZESPEED;
-        case CSSValueOptimizelegibility:
-            return TR_OPTIMIZELEGIBILITY;
-        case CSSValueGeometricprecision:
-            return TR_GEOMETRICPRECISION;
-        default:
-            ASSERT_NOT_REACHED();
-            return TR_AUTO;
-    }
-}
-
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
     : m_type(CSS_IDENT)
 {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 1bf526b..5ef6605 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -49,7 +49,6 @@ border-top-style
 border-top-width
 border-width
 bottom
-box-shadow
 caption-side
 clear
 clip
@@ -127,6 +126,7 @@ text-overline-color
 text-overline-mode
 text-overline-style
 text-overline-width
+text-rendering
 text-shadow
 text-transform
 text-underline
@@ -179,6 +179,7 @@ zoom
 -webkit-box-orient
 -webkit-box-pack
 -webkit-box-reflect
+-webkit-box-shadow
 -webkit-box-sizing
 -webkit-column-break-after
 -webkit-column-break-before
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index 9d9dd1b..313528f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -99,6 +99,9 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, focus, ("focus"));
     DEFINE_STATIC_LOCAL(AtomicString, hover, ("hover"));
     DEFINE_STATIC_LOCAL(AtomicString, indeterminate, ("indeterminate"));
+#if ENABLE(DATALIST)
+    DEFINE_STATIC_LOCAL(AtomicString, inputListButton, ("-webkit-input-list-button"));
+#endif
     DEFINE_STATIC_LOCAL(AtomicString, inputPlaceholder, ("-webkit-input-placeholder"));
     DEFINE_STATIC_LOCAL(AtomicString, lastChild, ("last-child"));
     DEFINE_STATIC_LOCAL(AtomicString, lastOfType, ("last-of-type"));
@@ -197,7 +200,14 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoFirstChild;
     else if (m_value == fullPageMedia)
         m_pseudoType = PseudoFullPageMedia;
-    else if (m_value == inputPlaceholder) {
+    else
+#if ENABLE(DATALIST)
+    if (m_value == inputListButton) {
+        m_pseudoType = PseudoInputListButton;
+        element = true;
+    } else
+#endif
+    if (m_value == inputPlaceholder) {
         m_pseudoType = PseudoInputPlaceholder;
         element = true;
     } else if (m_value == lastChild)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 7836136..0c3b677 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -183,7 +183,8 @@ namespace WebCore {
             PseudoMediaControlsRewindButton,
             PseudoMediaControlsReturnToRealtimeButton,
             PseudoMediaControlsStatusDisplay,
-            PseudoMediaControlsFullscreenButton
+            PseudoMediaControlsFullscreenButton,
+            PseudoInputListButton
         };
 
         PseudoType pseudoType() const
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index dc9f2e5..181e480 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -2494,6 +2494,11 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFileUploadButton:
                 dynamicPseudo = FILE_UPLOAD_BUTTON;
                 return true;
+#if ENABLE(DATALIST)
+            case CSSSelector::PseudoInputListButton:
+                dynamicPseudo = INPUT_LIST_BUTTON;
+                return true;
+#endif
             case CSSSelector::PseudoInputPlaceholder:
                 dynamicPseudo = INPUT_PLACEHOLDER;
                 return true;
@@ -4634,9 +4639,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(outlineOffset, OutlineOffset)
         m_style->setOutlineOffset(primitiveValue->computeLengthInt(style(), m_rootElementStyle, zoomFactor));
         return;
-
+    case CSSPropertyTextRendering: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setTextRenderingMode(m_parentStyle->fontDescription().textRenderingMode());
+        else if (isInitial)
+            fontDescription.setTextRenderingMode(AutoTextRendering);
+        else {
+            if (!primitiveValue)
+                return;
+            fontDescription.setTextRenderingMode(*primitiveValue);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
     case CSSPropertyTextShadow:
-    case CSSPropertyBoxShadow: {
+    case CSSPropertyWebkitBoxShadow: {
         if (isInherit) {
             if (id == CSSPropertyTextShadow)
                 return m_style->setTextShadow(m_parentStyle->textShadow() ? new ShadowData(*m_parentStyle->textShadow()) : 0);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index 791f425..1b7b1d8 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -501,6 +501,7 @@ square-button
 button
 button-bevel
 default-button
+list-button
 listbox
 listitem
 media-fullscreen-button
@@ -631,3 +632,9 @@ stroke
 # none
 antialiased
 subpixel-antialiased
+
+# text-rendering
+#auto
+optimizeSpeed
+optimizeLegibility
+geometricPrecision
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 2cd90a9..e8492d4 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -93,8 +93,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
             return CSSPrimitiveValue::create(svgStyle->strokeMiterLimit(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyStrokeOpacity:
             return CSSPrimitiveValue::create(svgStyle->strokeOpacity(), CSSPrimitiveValue::CSS_NUMBER);
-        case CSSPropertyTextRendering:
-            return CSSPrimitiveValue::create(svgStyle->textRendering());
         case CSSPropertyAlignmentBaseline:
             return CSSPrimitiveValue::create(svgStyle->alignmentBaseline());
         case CSSPropertyDominantBaseline:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index 04ba185..0ae9fbc 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -132,12 +132,6 @@ bool CSSParser::parseSVGValue(int propId, bool important)
             valid_primitive = true;
         break;
 
-    case CSSPropertyTextRendering:   // auto | optimizeSpeed | optimizeLegibility | geometricPrecision | inherit
-        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility ||
-       id == CSSValueGeometricprecision)
-            valid_primitive = true;
-        break;
-
     case CSSPropertyImageRendering:  // auto | optimizeSpeed |
     case CSSPropertyColorRendering:  // optimizeQuality | inherit
         if (id == CSSValueAuto || id == CSSValueOptimizespeed ||
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
index 965fbbf..e400ffe 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
@@ -37,7 +37,7 @@ stroke-linejoin
 stroke-miterlimit
 stroke-opacity
 stroke-width
-text-rendering
+# text-rendering
 alignment-baseline
 baseline-shift
 dominant-baseline
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index d326dde..b81b4f2 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -229,13 +229,6 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
                 svgstyle->setShapeRendering(*primitiveValue);
             break;
         }
-        case CSSPropertyTextRendering:
-        {
-            HANDLE_INHERIT_AND_INITIAL(textRendering, TextRendering)
-            if (primitiveValue)
-                svgstyle->setTextRendering(*primitiveValue);
-            break;
-        }
         // end of ident only properties
         case CSSPropertyFill:
         {
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
index c866a17..152a68f 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
@@ -196,7 +196,7 @@ linearRGB
 
 # CSS_PROP_COLOR_RENDERING
 #auto
-optimizeSpeed
+#optimizeSpeed
 optimizeQuality
 
 ## CSS_PROP_FILL
@@ -220,7 +220,7 @@ optimizeQuality
 #auto
 #optimizeSpeed
 crispEdges
-geometricPrecision
+#geometricPrecision
 
 # CSS_PROP_STROKE
 # CSS_PROP_STROKE_DASHARRAY
@@ -238,11 +238,6 @@ bevel
 # CSS_PROP_STROKE_MITERLIMIT
 # CSS_PROP_STROKE_OPACITY
 # CSS_PROP_STROKE_WIDTH
-# CSS_PROP_TEXT_RENDERING
-#auto
-#optimizeSpeed
-optimizeLegibility
-#geometricPrecision
 
 # CSS_PROP_ALIGNMENT_BASELINE
 #auto
diff --git a/src/3rdparty/webkit/WebCore/css/html.css b/src/3rdparty/webkit/WebCore/css/html.css
index 30d5661..095fab3 100644
--- a/src/3rdparty/webkit/WebCore/css/html.css
+++ b/src/3rdparty/webkit/WebCore/css/html.css
@@ -354,6 +354,11 @@ input[type="search"]::-webkit-search-results-button {
     display: inline-block;
 }
 
+input::-webkit-input-list-button {
+    -webkit-appearance: list-button;
+    display: inline-block;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
diff --git a/src/3rdparty/webkit/WebCore/css/makevalues.pl b/src/3rdparty/webkit/WebCore/css/makevalues.pl
index 3f52e64..e49981d 100644
--- a/src/3rdparty/webkit/WebCore/css/makevalues.pl
+++ b/src/3rdparty/webkit/WebCore/css/makevalues.pl
@@ -86,7 +86,7 @@ const char* getValueName(unsigned short id);
 EOF
 close HEADER;
 
-system("gperf -L ANSI-C -E -C -n -o -t --key-positions=\"*\" -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf > CSSValueKeywords.c");
+system("gperf -L ANSI-C -E -C -n -o -t --key-positions=\"*\" -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf > CSSValueKeywords.c") == 0 || die "calling gperf failed: $?";
 
 open C, ">>CSSValueKeywords.c" || die "Could not open CSSValueKeywords.c for writing";
 print C  "static const char * const valueList[] = {\n";
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
index 16ff0e4..0f667bd 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
@@ -83,8 +83,8 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
     width: auto;
     height: 32px;
 
-    border-left-color: rgba(255, 255, 255, 0.2);
-    border-right-color: rgba(255, 255, 255, 0.2);
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
@@ -141,7 +141,7 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
     position: absolute;
     top: auto;
-    bottom: 8px;
+    bottom: 7px;
     left: 6px;
     right: 65px;
     height: 16px;
diff --git a/src/3rdparty/webkit/WebCore/css/qt/mediaControls-extras.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
index d85deae..a9c3609 100644
--- a/src/3rdparty/webkit/WebCore/css/qt/mediaControls-extras.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
@@ -25,18 +25,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+ /* QtWebKit media controls. Extends mediaControls.css */
+
 audio {
     height: 34px;
     width: 400px;
 }
 
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: end;
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    z-index: 0;
+    overflow: hidden;
+    height: 100%;
+    text-align: right;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+	display: none;
+}
+
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     left: auto;
     right: 5px;
     width: 12px;
     height: 12px;
     padding: 6px;
-    margin: 5px 0px;
+    margin: 5px 5px 5px 3px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -44,17 +64,18 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
-    margin: 5px 0px;
+    margin: 5px 3px 5px 5px;
 }
 
-audio::-webkit-media-controls-time-display, video::-webkit-media-controls-time-display {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 34px;
+}
 
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
@@ -66,6 +87,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     margin: 5px 0px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     /* Since MediaControlElements are always created with a renderer we have to hide
        the controls we don't use, so they don't mess up activation and event handling */
@@ -99,3 +128,11 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     display: none;
 }
 
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
+    display: none;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae..5cf48ae 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.h b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.h
new file mode 100644
index 0000000..fc5814a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef BeforeLoadEvent_h
+#define BeforeLoadEvent_h
+
+#include "Event.h"
+#include "EventNames.h"
+
+namespace WebCore {
+
+class BeforeLoadEvent : public Event {
+public:
+    virtual bool isBeforeLoadEvent() const { return true; }
+
+    static PassRefPtr<BeforeLoadEvent> create(const String& url)
+    {
+        return adoptRef(new BeforeLoadEvent(url));
+    }
+
+    void initBeforeLoadEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& url)
+    {
+        if (dispatched())
+            return;
+        
+        initEvent(type, canBubble, cancelable);
+
+        m_url = url;
+    }
+
+    const String& url() const { return m_url; }
+
+private:
+    BeforeLoadEvent(const String& url)
+        : Event(eventNames().beforeloadEvent, false, true)
+        , m_url(url)
+    {}
+
+    String m_url;
+};
+
+} // namespace WebCore
+
+#endif // BeforeLoadEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
new file mode 100644
index 0000000..d06a39d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] BeforeLoadEvent : Event {
+        void initBeforeLoadEvent(in DOMString type,
+                                 in boolean canBubble, 
+                                 in boolean cancelable,
+                                 in DOMString url);
+        readonly attribute DOMString url;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 7274b5d..5cd0781 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "BeforeLoadEvent.h"
 #include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
@@ -909,4 +910,15 @@ static void dispatchChildRemovalEvents(Node* child)
     }
 }
 
+bool ContainerNode::dispatchBeforeLoadEvent(const String& sourceURL)
+{
+    if (!document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+        return true;
+
+    RefPtr<ContainerNode> protector(this);
+    RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
+    dispatchEvent(beforeLoadEvent.get());
+    return !beforeLoadEvent->defaultPrevented();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
index aa480a7..9789f1f 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
@@ -71,6 +71,8 @@ public:
     void removeAllChildren();
 
     void cloneChildNodes(ContainerNode* clone);
+    
+    bool dispatchBeforeLoadEvent(const String& sourceURL);
 
 protected:
     ContainerNode(Document*, ConstructionType = CreateContainer);
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 6dba900..475a8c1 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -943,7 +943,7 @@ Element* Document::elementFromPoint(int x, int y) const
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+    IntPoint point = roundedIntPoint(FloatPoint((x + view()->scrollX()) * zoomFactor, (y + view()->scrollY()) * zoomFactor));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -973,7 +973,7 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+    IntPoint point = roundedIntPoint(FloatPoint((x + view()->scrollX()) * zoomFactor, (y + view()->scrollY()) * zoomFactor));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -1561,6 +1561,9 @@ void Document::open(Document* ownerDocument)
 
     implicitOpen();
 
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
+
     if (m_frame)
         m_frame->loader()->didExplicitOpen();
 }
@@ -1582,7 +1585,11 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    clear();
+    delete m_tokenizer;
+    m_tokenizer = 0;
+
+    removeChildren();
+
     m_tokenizer = createTokenizer();
     setParsing(true);
 
@@ -1664,7 +1671,7 @@ void Document::implicitClose()
         return;
     }
 
-    bool wasLocationChangePending = frame() && frame()->loader()->isScheduledLocationChangePending();
+    bool wasLocationChangePending = frame() && frame()->redirectScheduler()->locationChangePending();
     bool doload = !parsing() && m_tokenizer && !m_processingLoadEvent && !wasLocationChangePending;
     
     if (!doload)
@@ -1711,7 +1718,7 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    ImageLoader::dispatchPendingLoadEvents();
+    ImageLoader::dispatchPendingEvents();
     dispatchWindowLoadEvent();
     dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
     if (f)
@@ -1731,7 +1738,7 @@ void Document::implicitClose()
     // fires. This will improve onload scores, and other browsers do it.
     // If they wanna cheat, we can too. -dwh
 
-    if (frame()->loader()->isScheduledLocationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
+    if (frame()->redirectScheduler()->locationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
         // Just bail out. Before or during the onload we were shifted to another page.
         // The old i-Bench suite does this. When this happens don't bother painting or laying out.        
         view()->unscheduleRelayout();
@@ -1860,16 +1867,6 @@ void Document::finishParsing()
         m_tokenizer->finish();
 }
 
-void Document::clear()
-{
-    delete m_tokenizer;
-    m_tokenizer = 0;
-
-    removeChildren();
-    if (DOMWindow* domWindow = this->domWindow())
-        domWindow->removeAllEventListeners();
-}
-
 const KURL& Document::virtualURL() const
 {
     return m_url;
@@ -1969,7 +1966,7 @@ const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
         const UserStyleSheetVector* sheets = it->second;
         for (unsigned i = 0; i < sheets->size(); ++i) {
             const UserStyleSheet* sheet = sheets->at(i).get();
-            if (!UserContentURLPattern::matchesPatterns(url(), sheet->patterns()))
+            if (!UserContentURLPattern::matchesPatterns(url(), sheet->whitelist(), sheet->blacklist()))
                 continue;
             RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
             parsedSheet->setIsUserStyleSheet(true);
@@ -2160,7 +2157,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 url = frame->loader()->url().string();
             else
                 url = completeURL(url).string();
-            frame->loader()->scheduleHTTPRedirection(delay, url);
+            frame->redirectScheduler()->scheduleRedirect(delay, url);
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
@@ -2174,7 +2171,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         FrameLoader* frameLoader = frame->loader();
         if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
             frameLoader->stopAllLoaders();
-            frameLoader->scheduleLocationChange(blankURL(), String());
+            frame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
         }
     }
 }
@@ -2357,8 +2354,8 @@ void Document::removePendingSheet()
     if (!m_pendingStylesheets && m_tokenizer)
         m_tokenizer->executeScriptsWaitingForStylesheets();
 
-    if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && m_frame)
-        m_frame->loader()->gotoAnchor();
+    if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && view())
+        view()->scrollToFragment(m_frame->loader()->url());
 }
 
 void Document::updateStyleSelector()
@@ -2894,42 +2891,47 @@ void Document::dispatchWindowLoadEvent()
 
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
+    RefPtr<Event> event;
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
-        return Event::create();
-    if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
-        return KeyboardEvent::create();
-    if (eventType == "MessageEvent")
-        return MessageEvent::create();
-    if (eventType == "MouseEvent" || eventType == "MouseEvents")
-        return MouseEvent::create();
-    if (eventType == "MutationEvent" || eventType == "MutationEvents")
-        return MutationEvent::create();
-    if (eventType == "OverflowEvent")
-        return OverflowEvent::create();
-    if (eventType == "PageTransitionEvent")
-        return PageTransitionEvent::create();
-    if (eventType == "ProgressEvent")
-        return ProgressEvent::create();
+        event = Event::create();
+    else if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
+        event = KeyboardEvent::create();
+    else if (eventType == "MessageEvent")
+        event = MessageEvent::create();
+    else if (eventType == "MouseEvent" || eventType == "MouseEvents")
+        event = MouseEvent::create();
+    else if (eventType == "MutationEvent" || eventType == "MutationEvents")
+        event = MutationEvent::create();
+    else if (eventType == "OverflowEvent")
+        event = OverflowEvent::create();
+    else if (eventType == "PageTransitionEvent")
+        event = PageTransitionEvent::create();
+    else if (eventType == "ProgressEvent")
+        event = ProgressEvent::create();
 #if ENABLE(DOM_STORAGE)
-    if (eventType == "StorageEvent")
-        return StorageEvent::create();
+    else if (eventType == "StorageEvent")
+        event = StorageEvent::create();
 #endif
-    if (eventType == "TextEvent")
-        return TextEvent::create();
-    if (eventType == "UIEvent" || eventType == "UIEvents")
-        return UIEvent::create();
-    if (eventType == "WebKitAnimationEvent")
-        return WebKitAnimationEvent::create();
-    if (eventType == "WebKitTransitionEvent")
-        return WebKitTransitionEvent::create();
-    if (eventType == "WheelEvent")
-        return WheelEvent::create();
+    else if (eventType == "TextEvent")
+        event = TextEvent::create();
+    else if (eventType == "UIEvent" || eventType == "UIEvents")
+        event = UIEvent::create();
+    else if (eventType == "WebKitAnimationEvent")
+        event = WebKitAnimationEvent::create();
+    else if (eventType == "WebKitTransitionEvent")
+        event = WebKitTransitionEvent::create();
+    else if (eventType == "WheelEvent")
+        event = WheelEvent::create();
 #if ENABLE(SVG)
-    if (eventType == "SVGEvents")
-        return Event::create();
-    if (eventType == "SVGZoomEvents")
-        return SVGZoomEvent::create();
+    else if (eventType == "SVGEvents")
+        event = Event::create();
+    else if (eventType == "SVGZoomEvents")
+        event = SVGZoomEvent::create();
 #endif
+    if (event) {
+        event->setCreatedByDOM(true);
+        return event.release();
+    }
     ec = NOT_SUPPORTED_ERR;
     return 0;
 }
@@ -2960,6 +2962,8 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
         addListenerType(ANIMATIONITERATION_LISTENER);
     else if (eventType == eventNames().webkitTransitionEndEvent)
         addListenerType(TRANSITIONEND_LISTENER);
+    else if (eventType == eventNames().beforeloadEvent)
+        addListenerType(BEFORELOAD_LISTENER);
 }
 
 CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
@@ -4016,8 +4020,17 @@ void Document::finishedParsing()
 {
     setParsing(false);
     dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false));
-    if (Frame* f = frame())
+    if (Frame* f = frame()) {
         f->loader()->finishedParsing();
+
+#if ENABLE(INSPECTOR)
+        if (!page())
+            return;
+
+        if (InspectorController* controller = page()->inspectorController())
+            controller->mainResourceFiredDOMContentEvent(f->loader()->documentLoader(), url());
+#endif
+    }
 }
 
 Vector<String> Document::formElementsState() const
@@ -4230,7 +4243,7 @@ void Document::initSecurityContext()
     m_cookieURL = url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
 
-    if (FrameLoader::allowSubstituteDataAccessToLocal()) {
+    if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
         // and https://bugs.webkit.org/show_bug.cgi?id=19760 for further
@@ -4494,7 +4507,7 @@ void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const
     Frame* frame = this->frame();
     if (frame) {
         FrameLoader* frameLoader = frame->loader();
-        frameLoader->didLoadResourceByXMLHttpRequest(identifier, sourceString);
+        frameLoader->notifier()->didLoadResourceByXMLHttpRequest(identifier, sourceString);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index f05c9f9..09bba58 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -473,7 +473,6 @@ public:
     void write(const String& text, Document* ownerDocument = 0);
     void writeln(const String& text, Document* ownerDocument = 0);
     void finishParsing();
-    void clear();
 
     bool wellFormed() const { return m_wellFormed; }
 
@@ -615,7 +614,8 @@ public:
         ANIMATIONEND_LISTENER                = 0x100,
         ANIMATIONSTART_LISTENER              = 0x200,
         ANIMATIONITERATION_LISTENER          = 0x400,
-        TRANSITIONEND_LISTENER               = 0x800
+        TRANSITIONEND_LISTENER               = 0x800,
+        BEFORELOAD_LISTENER                  = 0x1000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index 822f860..e9b5480 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -172,6 +172,9 @@ module core {
                  attribute HTMLElement body
                      setter raises (DOMException);
 
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        readonly attribute HTMLHeadElement head;
+#endif
         readonly attribute HTMLCollection images;
         readonly attribute HTMLCollection applets;
         readonly attribute HTMLCollection links;
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 50ff033..621c63a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -123,6 +123,7 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
 void Element::removeAttribute(const QualifiedName& name, ExceptionCode& ec)
 {
     if (namedAttrMap) {
+        ec = 0;
         namedAttrMap->removeNamedItem(name, ec);
         if (ec == NOT_FOUND_ERR)
             ec = 0;
@@ -515,7 +516,7 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         return;
     }
 
-    const AtomicString& localName = (shouldIgnoreAttributeCase(this) && !name.string().impl()->isLower()) ? AtomicString(name.string().lower()) : name;
+    const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
 
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index 4088e2c..ba310ef 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -35,6 +35,7 @@ Event::Event()
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
+    , m_createdByDOM(false)
     , m_eventPhase(0)
     , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
@@ -49,6 +50,7 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
+    , m_createdByDOM(false)
     , m_eventPhase(0)
     , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
@@ -149,6 +151,11 @@ bool Event::isXMLHttpRequestProgressEvent() const
     return false;
 }
 
+bool Event::isBeforeLoadEvent() const
+{
+    return false;
+}
+
 #if ENABLE(SVG)
 bool Event::isSVGZoomEvent() const
 {
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index 7d06378..74a2f10 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -114,6 +114,7 @@ namespace WebCore {
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
         virtual bool isWebKitTransitionEvent() const;
+        virtual bool isBeforeLoadEvent() const;
 #if ENABLE(SVG)
         virtual bool isSVGZoomEvent() const;
 #endif
@@ -144,6 +145,9 @@ namespace WebCore {
 
         virtual Clipboard* clipboard() const { return 0; }
 
+        bool createdByDOM() const { return m_createdByDOM; }
+        void setCreatedByDOM(bool createdByDOM) { m_createdByDOM = createdByDOM; }
+
     protected:
         Event();
         Event(const AtomicString& type, bool canBubble, bool cancelable);
@@ -161,6 +165,9 @@ namespace WebCore {
         bool m_defaultHandled;
         bool m_cancelBubble;
 
+        // Whether this event was created by document.createEvent().
+        bool m_createdByDOM;
+
         unsigned short m_eventPhase;
         EventTarget* m_currentTarget;
         RefPtr<EventTarget> m_target;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 0eb98ec..2c4cd32 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -32,6 +32,7 @@ namespace WebCore {
     macro(abort) \
     macro(beforecopy) \
     macro(beforecut) \
+    macro(beforeload) \
     macro(beforepaste) \
     macro(beforeunload) \
     macro(blur) \
@@ -63,7 +64,6 @@ namespace WebCore {
     macro(keypress) \
     macro(keyup) \
     macro(load) \
-    macro(loadend) \
     macro(loadstart) \
     macro(message) \
     macro(mousedown) \
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp
index c73d514..d175d8b 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.cpp
@@ -34,6 +34,7 @@ namespace WebCore {
 ExceptionBase::ExceptionBase(const ExceptionCodeDescription& description)
     : m_code(description.code)
     , m_name(description.name)
+    , m_description(description.description)
 {
     if (description.name)
         m_message = String::format("%s: %s Exception %d", description.name, description.typeName, description.code);
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h
index 44fad7e..81e2d7f 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionBase.h
@@ -40,6 +40,7 @@ namespace WebCore {
         unsigned short code() const { return m_code; }
         String name() const { return m_name; }
         String message() const { return m_message; }
+        String description() const { return m_description; }
 
         String toString() const;
 
@@ -50,6 +51,7 @@ namespace WebCore {
         unsigned short m_code;
         String m_name;
         String m_message;
+        String m_description;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
index 0291a21..7bb8a50 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
@@ -65,25 +65,70 @@ static const char* const exceptionNames[] = {
     "QUOTA_EXCEEDED_ERR"
 };
 
+static const char* const exceptionDescriptions[] = {
+    "Index or size was negative, or greater than the allowed value.",
+    "The specified range of text did not fit into a DOMString.",
+    "A Node was inserted somewhere it doesn't belong.",
+    "A Node was used in a different document than the one that created it (that doesn't support it).",
+    "An invalid or illegal character was specified, such as in an XML name.",
+    "Data was specified for a Node which does not support data.",
+    "An attempt was made to modify an object where modifications are not allowed.",
+    "An attempt was made to reference a Node in a context where it does not exist.",
+    "The implementation did not support the requested type of object or operation.",
+    "An attempt was made to add an attribute that is already in use elsewhere.",
+    "An attempt was made to use an object that is not, or is no longer, usable.",
+    "An invalid or illegal string was specified.",
+    "An attempt was made to modify the type of the underlying object.",
+    "An attempt was made to create or change an object in a way which is incorrect with regard to namespaces.",
+    "A parameter or an operation was not supported by the underlying object.",
+    "A call to a method such as insertBefore or removeChild would make the Node invalid with respect to \"partial validity\", this exception would be raised and the operation would not be done.",
+    "The type of an object was incompatible with the expected type of the parameter associated to the object.",
+    "An attempt was made to break through the security policy of the user agent.",
+    // FIXME: Couldn't find a description in the HTML/DOM specifications for NETWORK_ERR, ABORT_ERR, URL_MISMATCH_ERR, and QUOTA_EXCEEDED_ERR
+    "A network error occured.",
+    "The user aborted a request.",
+    "A worker global scope represented an absolute URL that is not equal to the resulting absolute URL.",
+    "An attempt was made to add something to storage that exceeded the quota."
+};
+
 static const char* const rangeExceptionNames[] = {
     "BAD_BOUNDARYPOINTS_ERR",
     "INVALID_NODE_TYPE_ERR"
 };
 
+static const char* const rangeExceptionDescriptions[] = {
+    "The boundary-points of a Range did not meet specific requirements.",
+    "The container of an boundary-point of a Range was being set to either a node of an invalid type or a node with an ancestor of an invalid type."
+};
+
 static const char* const eventExceptionNames[] = {
     "UNSPECIFIED_EVENT_TYPE_ERR"
 };
 
+static const char* const eventExceptionDescriptions[] = {
+    "The Event's type was not specified by initializing the event before the method was called."
+};
+
 static const char* const xmlHttpRequestExceptionNames[] = {
     "NETWORK_ERR",
     "ABORT_ERR"
 };
 
+static const char* const xmlHttpRequestExceptionDescriptions[] = {
+    "A network error occured in synchronous requests.",
+    "The user aborted a request in synchronous requests."
+};
+
 #if ENABLE(XPATH)
 static const char* const xpathExceptionNames[] = {
     "INVALID_EXPRESSION_ERR",
     "TYPE_ERR"
 };
+
+static const char* const xpathExceptionDescriptions[] = {
+    "The expression had a syntax error or otherwise is not a legal expression according to the rules of the specific XPathEvaluator.",
+    "The expression could not be converted to return the specified type."
+};
 #endif
 
 #if ENABLE(SVG)
@@ -92,6 +137,12 @@ static const char* const svgExceptionNames[] = {
     "SVG_INVALID_VALUE_ERR",
     "SVG_MATRIX_NOT_INVERTABLE"
 };
+
+static const char* const svgExceptionDescriptions[] = {
+    "An object of the wrong type was passed to an operation.",
+    "An invalid value was passed to an operation or assigned to an attribute.",
+    "An attempt was made to invert a matrix that is not invertible."
+};
 #endif
 
 void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& description)
@@ -101,6 +152,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
     const char* typeName;
     int code = ec;
     const char* const* nameTable;
+    const char* const* descriptionTable;
     int nameTableSize;
     int nameTableOffset;
     ExceptionType type;
@@ -110,6 +162,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM Range";
         code -= RangeException::RangeExceptionOffset;
         nameTable = rangeExceptionNames;
+        descriptionTable = rangeExceptionDescriptions;
         nameTableSize = sizeof(rangeExceptionNames) / sizeof(rangeExceptionNames[0]);
         nameTableOffset = RangeException::BAD_BOUNDARYPOINTS_ERR;
     } else if (code >= EventException::EventExceptionOffset && code <= EventException::EventExceptionMax) {
@@ -117,6 +170,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM Events";
         code -= EventException::EventExceptionOffset;
         nameTable = eventExceptionNames;
+        descriptionTable = eventExceptionDescriptions;
         nameTableSize = sizeof(eventExceptionNames) / sizeof(eventExceptionNames[0]);
         nameTableOffset = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
     } else if (code >= XMLHttpRequestException::XMLHttpRequestExceptionOffset && code <= XMLHttpRequestException::XMLHttpRequestExceptionMax) {
@@ -124,6 +178,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "XMLHttpRequest";
         code -= XMLHttpRequestException::XMLHttpRequestExceptionOffset;
         nameTable = xmlHttpRequestExceptionNames;
+        descriptionTable = xmlHttpRequestExceptionDescriptions;
         nameTableSize = sizeof(xmlHttpRequestExceptionNames) / sizeof(xmlHttpRequestExceptionNames[0]);
         // XMLHttpRequest exception codes start with 101 and we don't want 100 empty elements in the name array
         nameTableOffset = XMLHttpRequestException::NETWORK_ERR;
@@ -133,6 +188,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM XPath";
         code -= XPathException::XPathExceptionOffset;
         nameTable = xpathExceptionNames;
+        descriptionTable = xpathExceptionDescriptions;
         nameTableSize = sizeof(xpathExceptionNames) / sizeof(xpathExceptionNames[0]);
         // XPath exception codes start with 51 and we don't want 51 empty elements in the name array
         nameTableOffset = XPathException::INVALID_EXPRESSION_ERR;
@@ -143,6 +199,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM SVG";
         code -= SVGException::SVGExceptionOffset;
         nameTable = svgExceptionNames;
+        descriptionTable = svgExceptionDescriptions;
         nameTableSize = sizeof(svgExceptionNames) / sizeof(svgExceptionNames[0]);
         nameTableOffset = SVGException::SVG_WRONG_TYPE_ERR;
 #endif
@@ -150,17 +207,20 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         type = DOMExceptionType;
         typeName = "DOM";
         nameTable = exceptionNames;
+        descriptionTable = exceptionDescriptions;
         nameTableSize = sizeof(exceptionNames) / sizeof(exceptionNames[0]);
         nameTableOffset = INDEX_SIZE_ERR;
     }
 
     description.typeName = typeName;
     description.name = (ec >= nameTableOffset && ec - nameTableOffset < nameTableSize) ? nameTable[ec - nameTableOffset] : 0;
+    description.description = (ec >= nameTableOffset && ec - nameTableOffset < nameTableSize) ? descriptionTable[ec - nameTableOffset] : 0;
     description.code = code;
     description.type = type;
 
     // All exceptions used in the DOM code should have names.
     ASSERT(description.name);
+    ASSERT(description.description);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
index 58b18e2..573fb36 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
@@ -77,6 +77,7 @@ namespace WebCore {
     struct ExceptionCodeDescription {
         const char* typeName; // has spaces and is suitable for use in exception description strings; maximum length is 10 characters
         const char* name; // exception name, also intended for use in exception description strings; 0 if name not known; maximum length is 27 characters
+        const char* description; // exception description, intended for use in exception strings; more readable explanation of error
         int code; // numeric value of the exception within a particular type
         ExceptionType type;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
index 2ef8bc2..3c84642 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
@@ -34,10 +34,11 @@
 namespace WebCore {
 
 MessageEvent::MessageEvent()
+    : m_data(SerializedScriptValue::create())
 {
 }
 
-MessageEvent::MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
+MessageEvent::MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
     : Event(eventNames().messageEvent, false, false)
     , m_data(data)
     , m_origin(origin)
@@ -51,7 +52,7 @@ MessageEvent::~MessageEvent()
 {
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
 {
     if (dispatched())
         return;
@@ -74,7 +75,7 @@ MessagePort* MessageEvent::messagePort()
     return (*m_ports)[0].get();
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
 {
     MessagePortArray* ports = 0;
     if (port) {
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
index 555ed47..b7f9b02 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
@@ -31,6 +31,7 @@
 #include "DOMWindow.h"
 #include "Event.h"
 #include "MessagePort.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -42,15 +43,15 @@ namespace WebCore {
         {
             return adoptRef(new MessageEvent);
         }
-        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, const String& data = "", const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
+        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, PassRefPtr<SerializedScriptValue> data = 0, const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
         {
             return adoptRef(new MessageEvent(data, origin, lastEventId, source, ports));
         }
         virtual ~MessageEvent();
 
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
 
-        const String& data() const { return m_data; }
+        SerializedScriptValue* data() const { return m_data.get(); }
         const String& origin() const { return m_origin; }
         const String& lastEventId() const { return m_lastEventId; }
         DOMWindow* source() const { return m_source.get(); }
@@ -59,15 +60,15 @@ namespace WebCore {
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
         MessagePort* messagePort();
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
 
         virtual bool isMessageEvent() const;
 
     private:
         MessageEvent();
-        MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
+        MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
 
-        String m_data;
+        RefPtr<SerializedScriptValue> m_data;
         String m_origin;
         String m_lastEventId;
         RefPtr<DOMWindow> m_source;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
index a32cc93..7e497fc 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
@@ -30,20 +30,20 @@ module events {
         GenerateConstructor,
         NoStaticTables
     ] MessageEvent : Event {
+        readonly attribute SerializedScriptValue data;
 
-        readonly attribute DOMString data;
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
         readonly attribute DOMWindow source;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute [CustomGetter] Array ports;
 
-        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
+        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
 
-        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
 #endif
 
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 50a0106..9f6e649 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -56,7 +56,7 @@ MessagePort::~MessagePort()
 }
 
 // FIXME: remove this when we update the ObjC bindings (bug #28774).
-void MessagePort::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -64,12 +64,12 @@ void MessagePort::postMessage(const String& message, MessagePort* port, Exceptio
     postMessage(message, &ports, ec);
 }
 
-void MessagePort::postMessage(const String& message, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
     postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void MessagePort::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (!m_entangledChannel)
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index e649d5d..0ab0f50 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -56,10 +56,10 @@ namespace WebCore {
         static PassRefPtr<MessagePort> create(ScriptExecutionContext& scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
 
-        void postMessage(const String& message, ExceptionCode&);
-        void postMessage(const String& message, const MessagePortArray*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String& message, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
 
         void start();
         void close();
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
index 34b2ce7..e1a3ac6 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
@@ -33,13 +33,13 @@
 namespace WebCore {
 
 
-PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     return new EventData(message, channels);
 }
 
-MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
-    : m_message(message.copy())
+MessagePortChannel::EventData::EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    : m_message(message->release())
     , m_channels(channels)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
index 4acfe7f..2321b1f 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -33,6 +33,8 @@
 
 #include "PlatformString.h"
 
+#include "SerializedScriptValue.h"
+
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -45,6 +47,7 @@ namespace WebCore {
     class MessagePortChannel;
     class PlatformMessagePortChannel;
     class ScriptExecutionContext;
+    class SerializedScriptValue;
     class String;
 
     // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
@@ -77,14 +80,14 @@ namespace WebCore {
 
         class EventData {
         public:
-            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannelArray>);
+            static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
-            const String& message() { return m_message; }
+            SerializedScriptValue* message() { return m_message.get(); }
             PassOwnPtr<MessagePortChannelArray> channels() { return m_channels.release(); }
 
         private:
-            EventData(const String& message, PassOwnPtr<MessagePortChannelArray>);
-            String m_message;
+            EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray>);
+            RefPtr<SerializedScriptValue> m_message;
             OwnPtr<MessagePortChannelArray> m_channels;
         };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
index 4ed85ce..87815b1 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
@@ -57,7 +57,7 @@ static int contentsX(AbstractView* abstractView)
     FrameView* frameView = frame->view();
     if (!frameView)
         return 0;
-    return frameView->scrollX();
+    return frameView->scrollX() / frame->pageZoomFactor();
 }
 
 static int contentsY(AbstractView* abstractView)
@@ -70,7 +70,7 @@ static int contentsY(AbstractView* abstractView)
     FrameView* frameView = frame->view();
     if (!frameView)
         return 0;
-    return frameView->scrollY();
+    return frameView->scrollY() / frame->pageZoomFactor();
 }
 
 MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> viewArg,
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 8404481..72993dd 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -64,6 +64,7 @@ void ProcessingInstruction::setData(const String& data, ExceptionCode&)
     int oldLength = m_data.length();
     m_data = data;
     document()->textRemoved(this, 0, oldLength);
+    checkStyleSheet();
 }
 
 String ProcessingInstruction::nodeName() const
@@ -142,13 +143,21 @@ void ProcessingInstruction::checkStyleSheet()
             }
 #endif
         } else {
+            if (m_cachedSheet) {
+                m_cachedSheet->removeClient(this);
+                m_cachedSheet = 0;
+            }
+            
+            String url = document()->completeURL(href).string();
+            if (!dispatchBeforeLoadEvent(url))
+                return;
+            
             m_loading = true;
             document()->addPendingSheet();
-            if (m_cachedSheet)
-                m_cachedSheet->removeClient(this);
+            
 #if ENABLE(XSLT)
             if (m_isXSL)
-                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(document()->completeURL(href).string());
+                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(url);
             else
 #endif
             {
@@ -156,10 +165,15 @@ void ProcessingInstruction::checkStyleSheet()
                 if (charset.isEmpty())
                     charset = document()->frame()->loader()->encoding();
 
-                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(document()->completeURL(href).string(), charset);
+                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(url, charset);
             }
             if (m_cachedSheet)
                 m_cachedSheet->addClient(this);
+            else {
+                // The request may have been denied if (for example) the stylesheet is local and the document is remote.
+                m_loading = false;
+                document()->removePendingSheet();
+            }
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
index 607c846..2c5f39a 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
@@ -97,4 +97,11 @@ void QualifiedName::init()
     }
 }
 
+const AtomicString& QualifiedName::localNameUpper() const
+{
+    if (!m_impl->m_localNameUpper)
+        m_impl->m_localNameUpper = m_impl->m_localName.upper();
+    return m_impl->m_localNameUpper;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
index 939927b..3b9f5c4 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
@@ -41,9 +41,10 @@ public:
             return adoptRef(new QualifiedNameImpl(prefix, localName, namespaceURI));
         }
 
-        AtomicString m_prefix;
-        AtomicString m_localName;
-        AtomicString m_namespace;
+        const AtomicString m_prefix;
+        const AtomicString m_localName;
+        const AtomicString m_namespace;
+        mutable AtomicString m_localNameUpper;
 
     private:
         QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
@@ -76,6 +77,9 @@ public:
     const AtomicString& localName() const { return m_impl->m_localName; }
     const AtomicString& namespaceURI() const { return m_impl->m_namespace; }
 
+    // Uppercased localName, cached for efficiency
+    const AtomicString& localNameUpper() const;
+
     String toString() const;
 
     QualifiedNameImpl* impl() const { return m_impl; }
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
index fe38b46..827aff3 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
@@ -151,6 +151,9 @@ void ScriptElementData::requestScript(const String& sourceUrl)
     if (!document->frame())
         return;
 
+    if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
+        return;
+
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
     m_requested = true;
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index 5212380..46ce137 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -240,8 +240,8 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
         if (namedAttrMap) {
             if (attr->isNull())
                 namedAttrMap->setID(nullAtom);
-            else if (document()->inCompatMode() && !attr->value().impl()->isLower())
-                namedAttrMap->setID(AtomicString(attr->value().string().lower()));
+            else if (document()->inCompatMode())
+                namedAttrMap->setID(attr->value().lower());
             else
                 namedAttrMap->setID(attr->value());
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 4d06343..543927d 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -40,6 +40,7 @@
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
 #include "HTMLStyleElement.h"
+#include "ImageLoader.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
 #include "ResourceHandle.h"
@@ -105,6 +106,9 @@ void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     }
     
     doWrite(s.toString());
+    
+    // After parsing, go ahead and dispatch image beforeload/load events.
+    ImageLoader::dispatchPendingEvents();
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -296,7 +300,7 @@ void XMLTokenizer::notifyFinished(CachedResource* unusedResource)
     if (errorOccurred) 
         scriptElement->dispatchErrorEvent();
     else {
-        m_view->frame()->loader()->executeScript(sourceCode);
+        m_view->frame()->script()->executeScript(sourceCode);
         scriptElement->dispatchLoadEvent();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index d3c6546..6cc0a0c 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -851,7 +851,8 @@ void XMLTokenizer::endElementNs()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -861,7 +862,7 @@ void XMLTokenizer::endElementNs()
             } else 
                 m_scriptElement = 0;
         } else
-            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+            m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
     setCurrentNode(parent.get());
@@ -886,7 +887,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     if (m_parserStopped)
         return;
 
-#if PLATFORM(WIN_OS)
+#if COMPILER(MSVC)
     char m[1024];
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
@@ -900,7 +901,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     else
         handleError(type, m, lineNumber(), columnNumber());
 
-#if !PLATFORM(WIN_OS)
+#if !COMPILER(MSVC)
     free(m);
 #endif
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 04405d6..65cbc21 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -611,7 +611,8 @@ void XMLTokenizer::parseEndElement()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -621,7 +622,7 @@ void XMLTokenizer::parseEndElement()
             } else 
                 m_scriptElement = 0;
         } else
-            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+            m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
     setCurrentNode(parent.get());
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 0c3aa42..89d862f 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -383,7 +383,11 @@ size_t numEditingStyleProperties = sizeof(editingStyleProperties)/sizeof(editing
 PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, ShouldIncludeTypingStyle shouldIncludeTypingStyle)
 {
     RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = pos.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
+    RefPtr<CSSMutableStyleDeclaration> style;
+    if (!computedStyleAtPosition)
+        style = CSSMutableStyleDeclaration::create();
+    else
+        style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
 
     if (style && pos.node() && pos.node()->computedStyle()) {
         RenderStyle* renderStyle = pos.node()->computedStyle();
@@ -1075,6 +1079,23 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
     }
 }
 
+bool ApplyStyleCommand::shouldRemoveTextDecorationTag(CSSStyleDeclaration* styleToApply, int textDecorationAddedByTag) const
+{
+    // Honor text-decorations-in-effect
+    RefPtr<CSSValue> textDecorationsToApply = styleToApply->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    if (!textDecorationsToApply || !textDecorationsToApply->isValueList())
+        textDecorationsToApply = styleToApply->getPropertyCSSValue(CSSPropertyTextDecoration);
+
+    // When there is no text decorations to apply, remove any one of u, s, & strike
+    if (!textDecorationsToApply || !textDecorationsToApply->isValueList())
+        return true;
+
+    // Remove node if it implicitly adds style not present in styleToApply
+    CSSValueList* valueList = static_cast<CSSValueList*>(textDecorationsToApply.get());
+    RefPtr<CSSPrimitiveValue> value = CSSPrimitiveValue::createIdentifier(textDecorationAddedByTag);
+    return !valueList->hasValue(value.get());
+}
+
 // This function maps from styling tags to CSS styles.  Used for knowing which
 // styling tags should be removed when toggling styles.
 bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement* elem, CSSMutableStyleDeclaration* style)
@@ -1088,36 +1109,25 @@ bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(
         case CSSPropertyFontWeight:
             // IE inserts "strong" tags for execCommand("bold"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(bTag) || elem->hasLocalName(strongTag))
-                return true;
+                return !equalIgnoringCase(property.value()->cssText(), "bold") || !elem->hasChildNodes();
             break;
         case CSSPropertyVerticalAlign:
-            if (elem->hasLocalName(subTag) || elem->hasLocalName(supTag))
-                return true;
+            if (elem->hasLocalName(subTag))
+                return !equalIgnoringCase(property.value()->cssText(), "sub") || !elem->hasChildNodes();
+            if (elem->hasLocalName(supTag))
+                return !equalIgnoringCase(property.value()->cssText(), "sup") || !elem->hasChildNodes();
             break;
         case CSSPropertyFontStyle:
             // IE inserts "em" tags for execCommand("italic"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(iTag) || elem->hasLocalName(emTag))
-                return true;
+                return !equalIgnoringCase(property.value()->cssText(), "italic") || !elem->hasChildNodes();
             break;
         case CSSPropertyTextDecoration:
         case CSSPropertyWebkitTextDecorationsInEffect:
-                ASSERT(property.value());
-                if (property.value()->isValueList()) {
-                    CSSValueList* valueList = static_cast<CSSValueList*>(property.value());
-                    DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
-                    DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
-                    // Because style is new style to be applied, we delete element only if the element is not used in style.
-                    if (!valueList->hasValue(underline.get()) && elem->hasLocalName(uTag))
-                        return true;
-                    if (!valueList->hasValue(lineThrough.get()) && (elem->hasLocalName(strikeTag) || elem->hasLocalName(sTag)))
-                        return true;
-                } else {
-                    // If the value is NOT a list, then it must be "none", in which case we should remove all text decorations.
-                    ASSERT(property.value()->cssText() == "none");
-                    if (elem->hasLocalName(uTag) || elem->hasLocalName(strikeTag) || elem->hasLocalName(sTag))
-                        return true;
-                }
-                break;
+                if (elem->hasLocalName(uTag))
+                    return shouldRemoveTextDecorationTag(style, CSSValueUnderline) || !elem->hasChildNodes();
+                else if (elem->hasLocalName(sTag) || elem->hasTagName(strikeTag))
+                    return shouldRemoveTextDecorationTag(style,CSSValueLineThrough) || !elem->hasChildNodes();
         }
     }
     return false;
@@ -1303,19 +1313,18 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
     if (!style || style->cssText().isEmpty())
         return;
 
-    if (node->isTextNode()) {
-        RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
-        surroundNodeRangeWithElement(node, node, styleSpan.get());
-        node = styleSpan.get();
-    }
-
-    if (!node->isElementNode())
-        return;
+    StyleChange styleChange(style, Position(node, 0));
+    if (styleChange.cssStyle().length()) {
+        if (node->isTextNode()) {
+            RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
+            surroundNodeRangeWithElement(node, node, styleSpan.get());
+            node = styleSpan.get();
+        }
 
-    HTMLElement *element = static_cast<HTMLElement *>(node);
+        if (!node->isElementNode())
+            return;
 
-    StyleChange styleChange(style, Position(element, 0));
-    if (styleChange.cssStyle().length()) {
+        HTMLElement *element = static_cast<HTMLElement *>(node);
         String cssText = styleChange.cssStyle();
         CSSMutableStyleDeclaration *decl = element->inlineStyleDecl();
         if (decl)
@@ -1675,6 +1684,20 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(Node* startNode, Node* endN
             break;
         node = next;
     }
+
+    Node* nextSibling = element->nextSibling();
+    Node* previousSibling = element->previousSibling();
+    if (nextSibling && nextSibling->isElementNode() && nextSibling->isContentEditable()
+        && areIdenticalElements(element.get(), static_cast<Element*>(nextSibling)))
+        mergeIdenticalElements(element, static_cast<Element*>(nextSibling));
+
+    if (previousSibling && previousSibling->isElementNode() && previousSibling->isContentEditable()) {
+        Node* mergedElement = previousSibling->nextSibling();
+        if (mergedElement->isElementNode() && mergedElement->isContentEditable()
+            && areIdenticalElements(static_cast<Element*>(previousSibling), static_cast<Element*>(mergedElement)))
+            mergeIdenticalElements(static_cast<Element*>(previousSibling), static_cast<Element*>(mergedElement));
+    }
+
     // FIXME: We should probably call updateStartEnd if the start or end was in the node
     // range so that the endingSelection() is canonicalized.  See the comments at the end of
     // VisibleSelection::validate().
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
index 29aa483..2804604 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
@@ -62,6 +62,7 @@ private:
     CSSMutableStyleDeclaration* style() const { return m_style.get(); }
 
     // style-removal helpers
+    bool shouldRemoveTextDecorationTag(CSSStyleDeclaration* styleToApply, int textDecorationAddedByTag) const;
     bool implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement*, CSSMutableStyleDeclaration*);
     void replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&);
     void removeHTMLFontStyle(CSSMutableStyleDeclaration*, HTMLElement*);
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index 196a4da..abd0174 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -1096,6 +1097,19 @@ static bool enabledVisibleSelection(Frame* frame, Event* event, EditorCommandSou
     return (selection.isCaret() && selection.isContentEditable()) || selection.isRange();
 }
 
+static bool caretBrowsingEnabled(Frame* frame)
+{
+    return frame->settings() && frame->settings()->caretBrowsingEnabled();
+}
+
+static EditorCommandSource dummyEditorCommandSource = static_cast<EditorCommandSource>(0);
+
+static bool enabledVisibleSelectionOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledVisibleSelection, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledVisibleSelection(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledVisibleSelectionAndMark(Frame* frame, Event* event, EditorCommandSource)
 {
     const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
@@ -1140,6 +1154,12 @@ static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSourc
     return frame->editor()->selectionForCommand(event).isContentEditable();
 }
 
+static bool enabledInEditableTextOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledInEditableText, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledInEditableText(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledInRichlyEditableText(Frame* frame, Event*, EditorCommandSource)
 {
     return frame->selection()->isCaretOrRange() && frame->selection()->isContentRichlyEditable();
@@ -1330,20 +1350,20 @@ static const CommandMap& createCommandMap()
         { "MakeTextWritingDirectionRightToLeft", { executeMakeTextWritingDirectionRightToLeft, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateTextWritingDirectionRightToLeft, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackward", { executeMoveBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackwardAndModifySelection", { executeMoveBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForward", { executeMoveForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForwardAndModifySelection", { executeMoveForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDown", { executeMovePageDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDownAndModifySelection", { executeMovePageDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUp", { executeMovePageUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUpAndModifySelection", { executeMovePageUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocument", { executeMoveToBeginningOfDocument, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocumentAndModifySelection", { executeMoveToBeginningOfDocumentAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfLine", { executeMoveToBeginningOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1364,16 +1384,16 @@ static const CommandMap& createCommandMap()
         { "MoveToLeftEndOfLineAndModifySelection", { executeMoveToLeftEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLine", { executeMoveToRightEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLineAndModifySelection", { executeMoveToRightEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackward", { executeMoveWordBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackwardAndModifySelection", { executeMoveWordBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForward", { executeMoveWordForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForwardAndModifySelection", { executeMoveWordForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Outdent", { executeOutdent, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Paste", { executePaste, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "PasteAndMatchStyle", { executePasteAndMatchStyle, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 308ba74..84fa147 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -33,7 +33,6 @@
 #include "InsertLineBreakCommand.h"
 #include "InsertListCommand.h"
 #include "Range.h"
-#include "DocumentFragment.h"
 #include "SplitElementCommand.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
@@ -68,6 +67,37 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 {
 }
 
+// This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
+// correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
+PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
+{
+    int currentBlockquoteLevel = 0;
+    int lastBlockquoteLevel = 0;
+    Node* node = currentParagraph.deepEquivalent().node();
+    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
+        currentBlockquoteLevel++;
+    node = lastBlockquote.get();
+    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
+        lastBlockquoteLevel++;
+    while (currentBlockquoteLevel > lastBlockquoteLevel) {
+        RefPtr<Element> newBlockquote = createIndentBlockquoteElement(document());
+        appendNode(newBlockquote, lastBlockquote);
+        lastBlockquote = newBlockquote;
+        lastBlockquoteLevel++;
+    }
+    while (currentBlockquoteLevel < lastBlockquoteLevel) {
+        lastBlockquote = static_cast<Element*>(enclosingNodeWithTag(Position(lastBlockquote->parentNode(), 0), blockquoteTag));
+        lastBlockquoteLevel--;
+    }
+    RefPtr<Element> placeholder = createBreakElement(document());
+    appendNode(placeholder, lastBlockquote);
+    // Add another br before the placeholder if it collapsed.
+    VisiblePosition visiblePos(Position(placeholder.get(), 0));
+    if (!isStartOfParagraph(visiblePos))
+        insertNodeBefore(createBreakElement(document()), placeholder);
+    return placeholder.release();
+}
+
 bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
 {
     // If our selection is not inside a list, bail out.
@@ -81,14 +111,19 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     // FIXME: we need to deal with the case where there is no li (malformed HTML)
     if (!selectedListItem->hasTagName(liTag))
         return false;
-
+    
     // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
     Element* previousList = selectedListItem->previousElementSibling();
     Element* nextList = selectedListItem->nextElementSibling();
 
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
+    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
+    RefPtr<Element> placeholder = createBreakElement(document());
     insertNodeBefore(newList, selectedListItem);
-    appendParagraphIntoNode(visiblePositionBeforeNode(selectedListItem), visiblePositionAfterNode(selectedListItem), newList.get());
+    appendNode(newListItem, newList);
+    appendNode(placeholder, newListItem);
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
 
     if (canMergeLists(previousList, newList.get()))
         mergeIdenticalElements(previousList, newList);
@@ -98,79 +133,29 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     return true;
 }
     
-void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& startOfCurrentParagraph, const VisiblePosition& endOfCurrentParagraph, RefPtr<Element>& targetBlockquote, Node* nodeToSplitTo)
+void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
 {
     Node* enclosingCell = 0;
 
     if (!targetBlockquote) {
-        // Create a new blockquote and insert it as a child of the enclosing block element. We accomplish
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
         // this by splitting all parents of the current paragraph up to that point.
         targetBlockquote = createIndentBlockquoteElement(document());
-        if (isTableCell(nodeToSplitTo))
-            enclosingCell = nodeToSplitTo;
-        RefPtr<Node> startOfNewBlock = splitTreeToNode(startOfCurrentParagraph.deepEquivalent().node(), nodeToSplitTo);
+        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+        enclosingCell = enclosingNodeOfType(start, &isTableCell);
+        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
+        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
         insertNodeBefore(targetBlockquote, startOfNewBlock);
     }
 
-    VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-    appendParagraphIntoNode(startOfCurrentParagraph, endOfCurrentParagraph, targetBlockquote.get());
+    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
 
     // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
     // the next paragraph is in the same cell.
     if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
         targetBlockquote = 0;
-}
-
-// Enclose all nodes between start and end by newParent, which is a sibling node of nodes between start and end
-// FIXME: moveParagraph is overly complicated.  We need to clean up moveParagraph so that it uses appendParagraphIntoNode
-// or prepare more specialized functions and delete moveParagraph
-void IndentOutdentCommand::appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent)
-{
-    ASSERT(newParent);
-    ASSERT(newParent->isContentEditable());
-    ASSERT(isStartOfParagraph(start) && isEndOfParagraph(end));
-
-    Position endOfParagraph = end.deepEquivalent().downstream();
-    Node* insertionPoint = newParent->lastChild();// Remember the place to put br later
-    // Look for the beginning of the last paragraph in newParent
-    Node* startOfLastParagraph = startOfParagraph(Position(newParent, newParent->childNodeCount())).deepEquivalent().node();
-    if (startOfLastParagraph && !startOfLastParagraph->isDescendantOf(newParent))
-        startOfLastParagraph = 0;
-
-    // Extend the range so that we can append wrapping nodes as well if they're containd within the paragraph
-    ExceptionCode ec = 0;
-    RefPtr<Range> selectedRange = createRange(document(), start, end, ec);
-    RefPtr<Range> extendedRange = extendRangeToWrappingNodes(selectedRange, selectedRange.get(), newParent->parentNode());
-    newParent->appendChild(extendedRange->extractContents(ec), ec);
-
-    // If the start of paragraph didn't change by appending nodes, we should insert br to seperate the paragraphs.
-    Node* startOfNewParagraph = startOfParagraph(Position(newParent, newParent->childNodeCount())).deepEquivalent().node();
-    if (startOfNewParagraph == startOfLastParagraph) {
-        if (insertionPoint)
-            newParent->insertBefore(createBreakElement(document()), insertionPoint->nextSibling(), ec);
-        else
-            newParent->appendChild(createBreakElement(document()), ec);
-    }
-
-    // Remove unnecessary br from the place where we moved the paragraph from
-    removeUnnecessaryLineBreakAt(endOfParagraph);
-}
-
-void IndentOutdentCommand::removeUnnecessaryLineBreakAt(const Position& endOfParagraph)
-{
-    // If there is something in this paragraph, then don't remove br.
-    if (!isStartOfParagraph(endOfParagraph) || !isEndOfParagraph(endOfParagraph))
-        return;
-
-    // We only care about br at the end of paragraph
-    Node* br = endOfParagraph.node();
-    Node* parentNode = br->parentNode();
-
-    // If the node isn't br or the parent node is empty, then don't remove.
-    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionInParentBeforeNode(parentNode), positionInParentAfterNode(parentNode)))
-        return;
 
-    removeNodeAndPruneAncestors(br);
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
 }
 
 void IndentOutdentCommand::indentRegion()
@@ -178,7 +163,8 @@ void IndentOutdentCommand::indentRegion()
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
-    RefPtr<Range> selectedRange = selection.firstRange();
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
 
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
@@ -203,24 +189,10 @@ void IndentOutdentCommand::indentRegion()
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (tryIndentingAsListItem(endOfCurrentParagraph))
             blockquoteForNextIndent = 0;
-        else {
-            VisiblePosition startOfCurrentParagraph = startOfParagraph(endOfCurrentParagraph);
-            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
-            // extend the region so that it contains all the ancestor blocks within the selection
-            ExceptionCode ec;
-            Element* unsplittableNode = unsplittableElementForPosition(endOfCurrentParagraph.deepEquivalent());
-            RefPtr<Range> originalRange = createRange(document(), endOfCurrentParagraph, endOfCurrentParagraph, ec);
-            RefPtr<Range> extendedRange = extendRangeToWrappingNodes(originalRange, selectedRange.get(), unsplittableNode);
-            if (originalRange != extendedRange) {
-                ExceptionCode ec = 0;
-                endOfCurrentParagraph = endOfParagraph(extendedRange->endPosition().previous());
-                blockNode = enclosingBlock(extendedRange->commonAncestorContainer(ec));
-            }
-
-            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-            indentIntoBlockquote(startOfCurrentParagraph, endOfCurrentParagraph, blockquoteForNextIndent, blockNode);
-            // blockquoteForNextIndent will be updated in the function
-        }
+        else
+            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+            // blockquoteForNextIndent maybe updated
+            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -229,7 +201,13 @@ void IndentOutdentCommand::indentRegion()
         }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-
+    
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::outdentParagraph()
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index d83128e..419f832f 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -46,14 +46,12 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent);
-    void removeUnnecessaryLineBreakAt(const Position& endOfParagraph);
-
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
+    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
     bool tryIndentingAsListItem(const VisiblePosition&);
-    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>& targetBlockquote, Node* nodeToSplitTo);
+    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index a3a43b3..b40dab2 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -695,8 +695,17 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     
     VisiblePosition destination = mergeForward ? endOfInsertedContent.next() : endOfInsertedContent;
     VisiblePosition startOfParagraphToMove = mergeForward ? startOfParagraph(endOfInsertedContent) : endOfInsertedContent.next();
+   
+    // Merging forward could result in deleting the destination anchor node.
+    // To avoid this, we add a placeholder node before the start of the paragraph.
+    if (endOfParagraph(startOfParagraphToMove) == destination) {
+        RefPtr<Node> placeholder = createBreakElement(document());
+        insertNodeBefore(placeholder, startOfParagraphToMove.deepEquivalent().node());
+        destination = VisiblePosition(Position(placeholder.get(), 0));
+    }
 
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
+    
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
     // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
@@ -705,6 +714,10 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
             m_firstNodeInserted = endingSelection().visibleStart().deepEquivalent().node();
+        // If we merged text nodes, m_lastLeafInserted could be null. If this is the case,
+        // we use m_firstNodeInserted.
+        if (!m_lastLeafInserted)
+            m_lastLeafInserted = m_firstNodeInserted;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index 8adfd71..206de86 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -237,7 +237,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace)
+        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 43e7c92..47714e7 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -983,8 +983,16 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                 if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
                     fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (fullySelectedRootStyle->length())
+                if (fullySelectedRootStyle->length()) {
+                    // Reset the CSS properties to avoid an assertion error in addStyleMarkup().
+                    // This assertion is caused at least when we select all text of a <body> element whose
+                    // 'text-decoration' property is "inherit", and copy it.
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyTextDecoration))
+                        fullySelectedRootStyle->setProperty(CSSPropertyTextDecoration, CSSValueNone);
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyWebkitTextDecorationsInEffect))
+                        fullySelectedRootStyle->setProperty(CSSPropertyWebkitTextDecorationsInEffect, CSSValueNone);
                     addStyleMarkup(preMarkups, markups, fullySelectedRootStyle.get(), document, true);
+                }
             } else {
                 // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
                 // so that styles that affect the exterior of the node are not included.
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index 6428e64..335562e 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -554,9 +554,9 @@ union yyalloc
 #endif
 
 /* YYFINAL -- State number of the termination state.  */
-#define YYFINAL  28
+#define YYFINAL  24
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   1329
+#define YYLAST   1275
 
 /* YYNTOKENS -- Number of terminals.  */
 #define YYNTOKENS  86
@@ -565,7 +565,7 @@ union yyalloc
 /* YYNRULES -- Number of rules.  */
 #define YYNRULES  268
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  515
+#define YYNSTATES  516
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
@@ -617,130 +617,130 @@ static const yytype_uint8 yytranslate[] =
    YYRHS.  */
 static const yytype_uint16 yyprhs[] =
 {
-       0,     0,     3,    10,    13,    16,    19,    22,    25,    28,
-      31,    33,    35,    42,    49,    55,    61,    67,    73,    79,
-      80,    83,    84,    87,    90,    91,    93,    95,    97,   103,
-     107,   111,   112,   116,   118,   119,   123,   124,   128,   129,
-     133,   135,   137,   139,   141,   143,   145,   147,   149,   151,
-     152,   156,   158,   160,   162,   164,   166,   168,   170,   172,
-     174,   181,   188,   192,   196,   204,   212,   213,   217,   219,
-     222,   224,   228,   230,   233,   237,   242,   246,   252,   257,
-     262,   269,   274,   282,   285,   291,   295,   300,   303,   310,
-     314,   318,   319,   322,   324,   326,   329,   330,   335,   343,
-     345,   351,   352,   356,   357,   359,   361,   363,   368,   369,
-     371,   373,   378,   381,   389,   396,   399,   408,   410,   412,
-     413,   417,   424,   426,   432,   434,   436,   440,   444,   452,
-     456,   460,   463,   466,   469,   471,   473,   479,   481,   486,
-     489,   492,   494,   496,   499,   503,   506,   508,   511,   514,
-     516,   519,   521,   524,   528,   531,   533,   535,   537,   540,
-     543,   545,   547,   549,   551,   553,   556,   559,   564,   573,
-     579,   589,   591,   593,   595,   597,   599,   601,   603,   605,
-     608,   612,   617,   622,   627,   634,   636,   639,   641,   645,
-     647,   650,   653,   657,   662,   666,   672,   677,   682,   689,
-     695,   698,   701,   708,   715,   718,   722,   727,   730,   733,
-     736,   737,   739,   743,   746,   749,   752,   753,   755,   758,
-     761,   764,   767,   771,   774,   777,   779,   782,   784,   787,
-     790,   793,   796,   799,   802,   805,   808,   811,   814,   817,
-     820,   823,   826,   829,   832,   835,   838,   841,   844,   847,
-     850,   853,   855,   861,   865,   868,   871,   873,   876,   880,
-     884,   887,   891,   893,   895,   898,   904,   908,   910
+       0,     0,     3,    11,    14,    17,    20,    23,    26,    29,
+      32,    34,    36,    43,    50,    56,    62,    68,    74,    80,
+      81,    84,    85,    88,    91,    92,    94,    96,    98,   104,
+     108,   112,   113,   117,   119,   120,   124,   125,   129,   130,
+     134,   136,   138,   140,   142,   144,   146,   148,   150,   152,
+     153,   157,   159,   161,   163,   165,   167,   169,   171,   173,
+     175,   182,   189,   193,   197,   205,   213,   214,   218,   220,
+     223,   225,   229,   231,   234,   238,   243,   247,   253,   258,
+     263,   270,   275,   283,   286,   292,   296,   301,   304,   311,
+     315,   319,   320,   323,   325,   327,   330,   331,   336,   344,
+     346,   352,   353,   357,   358,   360,   362,   364,   369,   370,
+     372,   374,   379,   382,   390,   397,   400,   409,   411,   413,
+     414,   418,   425,   427,   433,   435,   437,   441,   445,   453,
+     457,   461,   464,   467,   470,   472,   474,   480,   482,   487,
+     490,   493,   495,   497,   500,   504,   507,   509,   512,   515,
+     517,   520,   522,   525,   529,   532,   534,   536,   538,   541,
+     544,   546,   548,   550,   552,   554,   557,   560,   565,   574,
+     580,   590,   592,   594,   596,   598,   600,   602,   604,   606,
+     609,   613,   618,   623,   628,   635,   637,   640,   642,   646,
+     648,   651,   654,   658,   663,   667,   673,   678,   683,   690,
+     696,   699,   702,   709,   716,   719,   723,   728,   731,   734,
+     737,   738,   740,   744,   747,   750,   753,   754,   756,   759,
+     762,   765,   768,   772,   775,   778,   780,   783,   785,   788,
+     791,   794,   797,   800,   803,   806,   809,   812,   815,   818,
+     821,   824,   827,   830,   833,   836,   839,   842,   845,   848,
+     851,   854,   856,   862,   866,   869,   872,   874,   877,   881,
+     885,   888,   892,   894,   896,   899,   905,   909,   911
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-      87,     0,    -1,    98,    97,   101,   102,   103,   104,    -1,
-      89,    96,    -1,    91,    96,    -1,    93,    96,    -1,    94,
-      96,    -1,    95,    96,    -1,    92,    96,    -1,    90,    96,
-      -1,   105,    -1,   110,    -1,    28,    71,    96,    88,    96,
-      72,    -1,    30,    71,    96,   134,    96,    72,    -1,    29,
-      71,    96,   156,    72,    -1,    38,    71,    96,   113,    72,
-      -1,    32,    71,    96,   161,    72,    -1,    33,     5,    96,
-     126,    72,    -1,    34,    71,    96,   142,    72,    -1,    -1,
-      96,     5,    -1,    -1,    97,     6,    -1,    97,     5,    -1,
-      -1,   100,    -1,    72,    -1,     0,    -1,    26,    96,    12,
-      96,    73,    -1,    26,     1,   174,    -1,    26,     1,    73,
-      -1,    -1,   101,   110,    97,    -1,   170,    -1,    -1,   102,
-     111,    97,    -1,    -1,   103,   117,    97,    -1,    -1,   104,
-     106,    97,    -1,   141,    -1,   129,    -1,   137,    -1,   138,
-      -1,   131,    -1,   105,    -1,   173,    -1,   169,    -1,   171,
-      -1,    -1,   107,   109,    97,    -1,   141,    -1,   137,    -1,
-     138,    -1,   131,    -1,   108,    -1,   173,    -1,   169,    -1,
-     171,    -1,   172,    -1,    22,    96,   119,    96,   127,    73,
-      -1,    22,    96,   119,    96,   127,   174,    -1,    22,     1,
-      73,    -1,    22,     1,   174,    -1,    35,    96,   127,    71,
-      96,   113,    72,    -1,    36,    96,   112,    71,    96,   113,
-      72,    -1,    -1,    37,     5,   128,    -1,   115,    -1,   114,
-     115,    -1,   114,    -1,     1,   175,     1,    -1,     1,    -1,
-     114,     1,    -1,   115,    73,    96,    -1,   115,   175,    73,
-      96,    -1,     1,    73,    96,    -1,     1,   175,     1,    73,
-      96,    -1,   114,   115,    73,    96,    -1,   114,     1,    73,
-      96,    -1,   114,     1,   175,     1,    73,    96,    -1,   116,
-      17,    96,   161,    -1,   116,    96,    71,    96,   156,    72,
-      96,    -1,   116,     1,    -1,   116,    17,    96,     1,   161,
-      -1,   116,    17,    96,    -1,   116,    17,    96,     1,    -1,
-      13,    96,    -1,    27,    96,   118,   119,    96,    73,    -1,
-      27,     1,   174,    -1,    27,     1,    73,    -1,    -1,    13,
-       5,    -1,    12,    -1,    66,    -1,    13,    96,    -1,    -1,
-      17,    96,   161,    96,    -1,    74,    96,   120,    96,   121,
-      75,    96,    -1,   122,    -1,   123,    96,    43,    96,   122,
-      -1,    -1,    43,    96,   123,    -1,    -1,    41,    -1,    42,
-      -1,   123,    -1,   125,    96,   130,   124,    -1,    -1,   128,
-      -1,   126,    -1,   128,    76,    96,   126,    -1,   128,     1,
-      -1,    24,    96,   128,    71,    96,   107,   168,    -1,    24,
-      96,    71,    96,   107,   168,    -1,    13,    96,    -1,    31,
-      96,   132,    96,    71,    96,   133,    72,    -1,    13,    -1,
-      12,    -1,    -1,   133,   134,    96,    -1,   135,    96,    71,
-      96,   156,    72,    -1,   136,    -1,   135,    96,    76,    96,
-     136,    -1,    63,    -1,    13,    -1,    23,     1,   174,    -1,
-      23,     1,    73,    -1,    25,    96,    71,    96,   156,    72,
-      96,    -1,    25,     1,   174,    -1,    25,     1,    73,    -1,
-      77,    96,    -1,    78,    96,    -1,    79,    96,    -1,    80,
-      -1,    77,    -1,   142,    71,    96,   156,    99,    -1,   144,
-      -1,   142,    76,    96,   144,    -1,   142,     1,    -1,   144,
-       5,    -1,   146,    -1,   143,    -1,   143,   146,    -1,   144,
-     139,   146,    -1,   144,     1,    -1,    21,    -1,    20,    21,
-      -1,    13,    21,    -1,   147,    -1,   147,   148,    -1,   148,
-      -1,   145,   147,    -1,   145,   147,   148,    -1,   145,   148,
-      -1,    13,    -1,    20,    -1,   149,    -1,   148,   149,    -1,
-     148,     1,    -1,    16,    -1,    15,    -1,   150,    -1,   152,
-      -1,   155,    -1,    18,    13,    -1,    13,    96,    -1,    19,
-      96,   151,    81,    -1,    19,    96,   151,   153,    96,   154,
-      96,    81,    -1,    19,    96,   145,   151,    81,    -1,    19,
-      96,   145,   151,   153,    96,   154,    96,    81,    -1,    82,
-      -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,    11,
-      -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,    17,
-      13,    -1,    17,    67,    14,    75,    -1,    17,    67,    65,
-      75,    -1,    17,    67,    13,    75,    -1,    17,    68,    96,
-     146,    96,    75,    -1,   158,    -1,   157,   158,    -1,   157,
-      -1,     1,   175,     1,    -1,     1,    -1,   157,     1,    -1,
-     157,   175,    -1,   158,    73,    96,    -1,   158,   175,    73,
-      96,    -1,     1,    73,    96,    -1,     1,   175,     1,    73,
-      96,    -1,   157,   158,    73,    96,    -1,   157,     1,    73,
-      96,    -1,   157,     1,   175,     1,    73,    96,    -1,   159,
-      17,    96,   161,   160,    -1,   165,    96,    -1,   159,     1,
-      -1,   159,    17,    96,     1,   161,   160,    -1,   159,    17,
-      96,   161,   160,     1,    -1,    40,    96,    -1,   159,    17,
-      96,    -1,   159,    17,    96,     1,    -1,   159,   174,    -1,
-      13,    96,    -1,    40,    96,    -1,    -1,   163,    -1,   161,
-     162,   163,    -1,   161,     1,    -1,    83,    96,    -1,    76,
-      96,    -1,    -1,   164,    -1,   140,   164,    -1,    12,    96,
-      -1,    13,    96,    -1,    62,    96,    -1,   140,    62,    96,
-      -1,    66,    96,    -1,    69,    96,    -1,   167,    -1,    84,
-      96,    -1,   166,    -1,   165,    96,    -1,    85,    96,    -1,
-      65,    96,    -1,    64,    96,    -1,    63,    96,    -1,    48,
-      96,    -1,    49,    96,    -1,    50,    96,    -1,    51,    96,
-      -1,    52,    96,    -1,    53,    96,    -1,    54,    96,    -1,
-      55,    96,    -1,    56,    96,    -1,    57,    96,    -1,    58,
-      96,    -1,    59,    96,    -1,    60,    96,    -1,    61,    96,
-      -1,    46,    96,    -1,    45,    96,    -1,    47,    96,    -1,
-      44,    96,    -1,    70,    -1,    67,    96,   161,    75,    96,
-      -1,    67,    96,     1,    -1,    15,    96,    -1,    16,    96,
-      -1,    99,    -1,     1,    99,    -1,    39,     1,   174,    -1,
-      39,     1,    73,    -1,   169,    97,    -1,   170,   169,    97,
-      -1,   110,    -1,   129,    -1,     1,   174,    -1,    71,     1,
-     175,     1,    99,    -1,    71,     1,    99,    -1,   174,    -1,
-     175,     1,   174,    -1
+      87,     0,    -1,    96,    98,    97,   101,   102,   103,   104,
+      -1,    89,    96,    -1,    91,    96,    -1,    93,    96,    -1,
+      94,    96,    -1,    95,    96,    -1,    92,    96,    -1,    90,
+      96,    -1,   105,    -1,   110,    -1,    28,    71,    96,    88,
+      96,    72,    -1,    30,    71,    96,   134,    96,    72,    -1,
+      29,    71,    96,   156,    72,    -1,    38,    71,    96,   113,
+      72,    -1,    32,    71,    96,   161,    72,    -1,    33,     5,
+      96,   126,    72,    -1,    34,    71,    96,   142,    72,    -1,
+      -1,    96,     5,    -1,    -1,    97,     6,    -1,    97,     5,
+      -1,    -1,   100,    -1,    72,    -1,     0,    -1,    26,    96,
+      12,    96,    73,    -1,    26,     1,   174,    -1,    26,     1,
+      73,    -1,    -1,   101,   110,    97,    -1,   170,    -1,    -1,
+     102,   111,    97,    -1,    -1,   103,   117,    97,    -1,    -1,
+     104,   106,    97,    -1,   141,    -1,   129,    -1,   137,    -1,
+     138,    -1,   131,    -1,   105,    -1,   173,    -1,   169,    -1,
+     171,    -1,    -1,   107,   109,    97,    -1,   141,    -1,   137,
+      -1,   138,    -1,   131,    -1,   108,    -1,   173,    -1,   169,
+      -1,   171,    -1,   172,    -1,    22,    96,   119,    96,   127,
+      73,    -1,    22,    96,   119,    96,   127,   174,    -1,    22,
+       1,    73,    -1,    22,     1,   174,    -1,    35,    96,   127,
+      71,    96,   113,    72,    -1,    36,    96,   112,    71,    96,
+     113,    72,    -1,    -1,    37,     5,   128,    -1,   115,    -1,
+     114,   115,    -1,   114,    -1,     1,   175,     1,    -1,     1,
+      -1,   114,     1,    -1,   115,    73,    96,    -1,   115,   175,
+      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
+      73,    96,    -1,   114,   115,    73,    96,    -1,   114,     1,
+      73,    96,    -1,   114,     1,   175,     1,    73,    96,    -1,
+     116,    17,    96,   161,    -1,   116,    96,    71,    96,   156,
+      72,    96,    -1,   116,     1,    -1,   116,    17,    96,     1,
+     161,    -1,   116,    17,    96,    -1,   116,    17,    96,     1,
+      -1,    13,    96,    -1,    27,    96,   118,   119,    96,    73,
+      -1,    27,     1,   174,    -1,    27,     1,    73,    -1,    -1,
+      13,     5,    -1,    12,    -1,    66,    -1,    13,    96,    -1,
+      -1,    17,    96,   161,    96,    -1,    74,    96,   120,    96,
+     121,    75,    96,    -1,   122,    -1,   123,    96,    43,    96,
+     122,    -1,    -1,    43,    96,   123,    -1,    -1,    41,    -1,
+      42,    -1,   123,    -1,   125,    96,   130,   124,    -1,    -1,
+     128,    -1,   126,    -1,   128,    76,    96,   126,    -1,   128,
+       1,    -1,    24,    96,   128,    71,    96,   107,   168,    -1,
+      24,    96,    71,    96,   107,   168,    -1,    13,    96,    -1,
+      31,    96,   132,    96,    71,    96,   133,    72,    -1,    13,
+      -1,    12,    -1,    -1,   133,   134,    96,    -1,   135,    96,
+      71,    96,   156,    72,    -1,   136,    -1,   135,    96,    76,
+      96,   136,    -1,    63,    -1,    13,    -1,    23,     1,   174,
+      -1,    23,     1,    73,    -1,    25,    96,    71,    96,   156,
+      72,    96,    -1,    25,     1,   174,    -1,    25,     1,    73,
+      -1,    77,    96,    -1,    78,    96,    -1,    79,    96,    -1,
+      80,    -1,    77,    -1,   142,    71,    96,   156,    99,    -1,
+     144,    -1,   142,    76,    96,   144,    -1,   142,     1,    -1,
+     144,     5,    -1,   146,    -1,   143,    -1,   143,   146,    -1,
+     144,   139,   146,    -1,   144,     1,    -1,    21,    -1,    20,
+      21,    -1,    13,    21,    -1,   147,    -1,   147,   148,    -1,
+     148,    -1,   145,   147,    -1,   145,   147,   148,    -1,   145,
+     148,    -1,    13,    -1,    20,    -1,   149,    -1,   148,   149,
+      -1,   148,     1,    -1,    16,    -1,    15,    -1,   150,    -1,
+     152,    -1,   155,    -1,    18,    13,    -1,    13,    96,    -1,
+      19,    96,   151,    81,    -1,    19,    96,   151,   153,    96,
+     154,    96,    81,    -1,    19,    96,   145,   151,    81,    -1,
+      19,    96,   145,   151,   153,    96,   154,    96,    81,    -1,
+      82,    -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,
+      11,    -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,
+      17,    13,    -1,    17,    67,    14,    75,    -1,    17,    67,
+      65,    75,    -1,    17,    67,    13,    75,    -1,    17,    68,
+      96,   146,    96,    75,    -1,   158,    -1,   157,   158,    -1,
+     157,    -1,     1,   175,     1,    -1,     1,    -1,   157,     1,
+      -1,   157,   175,    -1,   158,    73,    96,    -1,   158,   175,
+      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
+      73,    96,    -1,   157,   158,    73,    96,    -1,   157,     1,
+      73,    96,    -1,   157,     1,   175,     1,    73,    96,    -1,
+     159,    17,    96,   161,   160,    -1,   165,    96,    -1,   159,
+       1,    -1,   159,    17,    96,     1,   161,   160,    -1,   159,
+      17,    96,   161,   160,     1,    -1,    40,    96,    -1,   159,
+      17,    96,    -1,   159,    17,    96,     1,    -1,   159,   174,
+      -1,    13,    96,    -1,    40,    96,    -1,    -1,   163,    -1,
+     161,   162,   163,    -1,   161,     1,    -1,    83,    96,    -1,
+      76,    96,    -1,    -1,   164,    -1,   140,   164,    -1,    12,
+      96,    -1,    13,    96,    -1,    62,    96,    -1,   140,    62,
+      96,    -1,    66,    96,    -1,    69,    96,    -1,   167,    -1,
+      84,    96,    -1,   166,    -1,   165,    96,    -1,    85,    96,
+      -1,    65,    96,    -1,    64,    96,    -1,    63,    96,    -1,
+      48,    96,    -1,    49,    96,    -1,    50,    96,    -1,    51,
+      96,    -1,    52,    96,    -1,    53,    96,    -1,    54,    96,
+      -1,    55,    96,    -1,    56,    96,    -1,    57,    96,    -1,
+      58,    96,    -1,    59,    96,    -1,    60,    96,    -1,    61,
+      96,    -1,    46,    96,    -1,    45,    96,    -1,    47,    96,
+      -1,    44,    96,    -1,    70,    -1,    67,    96,   161,    75,
+      96,    -1,    67,    96,     1,    -1,    15,    96,    -1,    16,
+      96,    -1,    99,    -1,     1,    99,    -1,    39,     1,   174,
+      -1,    39,     1,    73,    -1,   169,    97,    -1,   170,   169,
+      97,    -1,   110,    -1,   129,    -1,     1,   174,    -1,    71,
+       1,   175,     1,    99,    -1,    71,     1,    99,    -1,   174,
+      -1,   175,     1,   174,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
@@ -873,7 +873,7 @@ static const yytype_uint8 yyr1[] =
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
 static const yytype_uint8 yyr2[] =
 {
-       0,     2,     6,     2,     2,     2,     2,     2,     2,     2,
+       0,     2,     7,     2,     2,     2,     2,     2,     2,     2,
        1,     1,     6,     6,     5,     5,     5,     5,     5,     0,
        2,     0,     2,     2,     0,     1,     1,     1,     5,     3,
        3,     0,     3,     1,     0,     3,     0,     3,     0,     3,
@@ -907,145 +907,145 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-      24,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-      19,    19,    19,    19,    19,    19,    19,    21,    25,     0,
-       0,    19,    19,    19,    19,    19,    19,    19,     1,     3,
-       9,     4,     8,     5,     6,     7,    31,     0,    30,    29,
-      20,    19,     0,     0,     0,     0,   103,     0,     0,    23,
-      22,     0,    34,    21,    33,     0,     0,   155,   161,   160,
-       0,     0,    19,   156,   146,     0,     0,    19,     0,    19,
-      19,    10,    11,    41,    44,    42,    43,    40,     0,   142,
-       0,     0,   141,   149,     0,   157,   162,   163,   164,   189,
-      19,    19,   251,     0,     0,   185,     0,    19,   125,   124,
-      19,    19,   122,    19,    19,    19,    19,    19,    19,    19,
+      19,     0,     0,     0,     0,     0,     0,     0,     0,    19,
+      19,    19,    19,    19,    19,    19,    24,    19,    19,    19,
+      19,    19,    19,    19,     1,     3,     9,     4,     8,     5,
+       6,     7,    20,     0,    21,    25,     0,     0,     0,     0,
+     103,     0,     0,     0,     0,    31,   155,   161,   160,     0,
+       0,    19,   156,   146,     0,     0,    19,     0,    19,    19,
+      10,    11,    41,    44,    42,    43,    40,     0,   142,     0,
+       0,   141,   149,     0,   157,   162,   163,   164,   189,    19,
+      19,   251,     0,     0,   185,     0,    19,   125,   124,    19,
+      19,   122,    19,    19,    19,    19,    19,    19,    19,    19,
       19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
       19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,    19,   135,   134,    19,    19,     0,     0,   211,   217,
-      19,   227,   225,   104,   105,    19,    99,   106,    19,     0,
-       0,    72,    19,     0,     0,    68,     0,     0,    36,    21,
-     260,    21,    27,    26,   266,   267,     0,    28,   148,   179,
-       0,     0,    19,   165,     0,   147,     0,     0,     0,   103,
-       0,     0,     0,     0,   139,    19,    19,   143,   145,   140,
-      19,    19,    19,     0,   155,   156,   152,     0,     0,   159,
-     158,    19,     0,   208,   204,    14,   190,   186,     0,    19,
-       0,   201,    19,   207,   200,     0,     0,   219,   220,   254,
-     255,   250,   248,   247,   249,   233,   234,   235,   236,   237,
-     238,   239,   240,   241,   242,   243,   244,   245,   246,   221,
-     232,   231,   230,   223,     0,   224,   226,   229,    19,   218,
-     213,    16,    19,    19,     0,   228,     0,     0,     0,    17,
-      18,    19,     0,    87,    15,    73,    69,    19,     0,    83,
-      19,     0,   259,   258,    19,    19,    38,    21,    32,   261,
-       0,   180,     0,     0,     0,     0,    19,     0,     0,     0,
-      62,    63,    93,    94,    19,   127,   126,    19,   110,     0,
-     130,   129,    19,   118,   117,    19,    12,     0,     0,   131,
-     132,   133,   144,     0,   194,   188,    19,     0,    19,     0,
-     192,    19,     0,    13,    19,    19,   253,     0,   222,   215,
-     214,   212,    19,    19,    19,    19,   101,    76,    71,    19,
-       0,    19,    74,    19,     0,    19,   103,    66,     0,     0,
-      21,    35,   265,   268,   183,   181,   182,    19,   166,    19,
-       0,   172,   173,   174,   175,   176,   167,   171,    19,   108,
-      49,   112,    19,    19,     0,     0,     0,     0,    19,   197,
-       0,   196,   193,   206,     0,     0,     0,    19,    95,    96,
-       0,   115,    19,   107,    19,    79,     0,    78,    75,    86,
-       0,     0,     0,     0,     0,     0,     0,    91,     0,    45,
-      21,   262,    47,    48,    46,    37,     0,   169,    19,     0,
-       0,     0,    49,   103,     0,    19,   136,   195,    19,     0,
-      19,     0,     0,   123,   252,    19,     0,   100,     0,    77,
-      19,     0,     0,    19,   103,    19,    90,    89,     0,     0,
-     264,    39,   184,     0,   178,   177,    19,    60,    61,     0,
-     256,    55,    21,   263,    54,    52,    53,    51,   114,    57,
-      58,    59,    56,     0,   111,    19,   119,   198,   202,   209,
-     203,   121,     0,    19,   102,    80,    19,     0,     0,     0,
-      92,    19,    19,     0,   257,    50,   113,   128,     0,     0,
-      98,    82,     0,     0,     0,     0,   168,   116,    19,    97,
-      64,    65,    88,   170,   120
+      19,   135,   134,    19,    19,     0,     0,   211,   217,    19,
+     227,   225,   104,   105,    19,    99,   106,    19,     0,     0,
+      72,    19,     0,     0,    68,     0,     0,    30,    29,    19,
+      23,    22,     0,    34,    21,    33,   148,   179,     0,     0,
+      19,   165,     0,   147,     0,     0,     0,   103,     0,     0,
+       0,     0,   139,    19,    19,   143,   145,   140,    19,    19,
+      19,     0,   155,   156,   152,     0,     0,   159,   158,    19,
+     267,     0,   208,   204,    14,   190,   186,     0,    19,     0,
+     201,    19,   207,   200,     0,     0,   219,   220,   254,   255,
+     250,   248,   247,   249,   233,   234,   235,   236,   237,   238,
+     239,   240,   241,   242,   243,   244,   245,   246,   221,   232,
+     231,   230,   223,     0,   224,   226,   229,    19,   218,   213,
+      16,    19,    19,     0,   228,     0,     0,     0,    17,    18,
+      19,     0,    87,    15,    73,    69,    19,     0,    83,    19,
+       0,     0,     0,     0,    36,    21,   260,    21,   180,     0,
+       0,     0,     0,    19,     0,     0,     0,    62,    63,    93,
+      94,    19,   127,   126,    19,   110,     0,   130,   129,    19,
+     118,   117,    19,    12,     0,     0,   131,   132,   133,   144,
+       0,   194,   188,    19,     0,    19,     0,   192,    19,     0,
+      13,    19,    19,   253,     0,   222,   215,   214,   212,    19,
+      19,    19,    19,   101,    76,    71,    19,     0,    19,    74,
+      19,     0,    19,    27,    26,   266,     0,    28,   259,   258,
+      19,    19,    38,    21,    32,   261,   183,   181,   182,    19,
+     166,    19,     0,   172,   173,   174,   175,   176,   167,   171,
+      19,   108,    49,   112,    19,    19,     0,     0,     0,     0,
+      19,   268,   197,     0,   196,   193,   206,     0,     0,     0,
+      19,    95,    96,     0,   115,    19,   107,    19,    79,     0,
+      78,    75,    86,     0,     0,     0,   103,    66,     0,     0,
+      21,    35,     0,   169,    19,     0,     0,     0,     0,    49,
+     103,     0,    19,   136,   195,    19,     0,    19,     0,     0,
+     123,   252,    19,     0,   100,     0,    77,    19,     0,     0,
+     265,     0,     0,     0,     0,    91,     0,    45,    21,   262,
+      47,    48,    46,    37,   184,     0,   178,   177,    19,    60,
+      61,     0,   256,    55,    21,   263,    54,    52,    53,    51,
+     114,    57,    58,    59,    56,     0,   111,    19,   119,   198,
+     202,   209,   203,   121,     0,    19,   102,    80,    19,    19,
+     103,    19,    90,    89,     0,     0,   264,    39,    19,     0,
+     257,    50,   113,   128,     0,     0,    98,    82,     0,     0,
+       0,    92,    19,     0,   168,   116,    19,    97,     0,     0,
+       0,   170,   120,    64,    65,    88
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     9,    70,    10,    11,    12,    13,    14,    15,    16,
-     257,    36,    17,   460,    18,    52,   158,   276,   349,    71,
-     410,   421,   461,   462,   411,   277,   405,   153,   154,   155,
-     156,   350,   449,   294,   333,   436,   146,   147,   393,   148,
-     298,   402,   403,    73,   336,    74,   305,   498,   100,   101,
-     102,    75,    76,   193,   136,    77,    78,    79,    80,    81,
-      82,    83,    84,    85,    86,   289,    87,   368,   456,    88,
-      93,    94,    95,    96,   431,   137,   254,   138,   139,   140,
-     141,   142,   468,   469,    54,   470,   471,   472,   165,   166
+      -1,     8,    59,     9,    10,    11,    12,    13,    14,    15,
+     246,    45,    34,   452,    35,   153,   264,   342,   399,    60,
+     438,   408,   453,   454,   439,   343,   433,   142,   143,   144,
+     145,   400,   485,   281,   320,   423,   135,   136,   386,   137,
+     285,   406,   407,    62,   323,    63,   292,   494,    89,    90,
+      91,    64,    65,   181,   125,    66,    67,    68,    69,    70,
+      71,    72,    73,    74,    75,   276,    76,   360,   448,    77,
+      82,    83,    84,    85,   418,   126,   243,   127,   128,   129,
+     130,   131,   460,   461,   155,   462,   463,   464,   190,   191
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -301
+#define YYPACT_NINF -240
 static const yytype_int16 yypact[] =
 {
-     467,    43,    -9,   143,   155,   174,    47,   179,   199,   202,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,   -15,
-     220,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,   233,
-     233,   233,   233,   233,   233,   233,    31,   325,  -301,  -301,
-    -301,  -301,   769,   191,   420,  1125,   407,   556,    38,  -301,
-    -301,   336,   290,  -301,   345,   146,    14,   374,  -301,  -301,
-     419,   393,  -301,   397,  -301,   402,   446,  -301,   194,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,    82,   616,
-     297,   629,  -301,   454,   164,  -301,  -301,  -301,  -301,   236,
-    -301,  -301,  -301,   384,   640,   237,   277,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,   807,   911,  -301,  -301,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,    28,  -301,   390,
-      87,   248,  -301,   394,   185,   308,   229,   355,   319,  -301,
-     405,  -301,  -301,  -301,  -301,  -301,   450,  -301,  -301,  -301,
-     471,   292,  -301,  -301,    25,  -301,   364,   285,   367,   311,
-     379,    22,    37,   196,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,   616,  -301,  -301,   454,   205,   344,  -301,
-    -301,  -301,   466,   233,   233,  -301,   484,   416,    94,  -301,
-      62,  -301,  -301,  -301,   233,   223,   183,   233,   233,   233,
-     233,   233,   233,   233,   233,   233,   233,   233,   233,   233,
-     233,   233,   233,   233,   233,   233,   233,   233,   233,   233,
-     233,   233,   233,   233,  1062,   233,   233,   233,  -301,  -301,
-    -301,  -301,  -301,  -301,  1184,   233,    60,    29,   383,  -301,
-    -301,  -301,   493,   233,  -301,   507,   429,  -301,    83,  -301,
-    -301,   192,  -301,  -301,  -301,  -301,   476,  -301,   405,   405,
-     146,  -301,   431,   457,   470,   556,   374,   397,   529,    68,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,    96,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,   191,   556,   233,
-     233,   233,  -301,   382,   233,   508,  -301,   545,  -301,   481,
-     233,  -301,   538,  -301,  -301,  -301,  -301,   985,   233,   233,
-     233,  -301,  -301,  -301,  -301,  -301,   519,   233,   541,  -301,
-     569,  -301,   233,  -301,   760,  -301,   404,    23,   555,   915,
-    -301,   405,  -301,  -301,  -301,  -301,  -301,  -301,   233,  -301,
-     167,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,   389,
-     233,  -301,  -301,  -301,   191,   208,   161,   487,  -301,   233,
-     546,   233,   233,  1184,   464,   191,   420,  -301,   233,    36,
-     131,   233,  -301,  -301,  -301,   233,   579,   233,   233,  1184,
-     612,   191,   535,    97,   611,   549,   620,   400,   481,  -301,
-    -301,  -301,  -301,  -301,  -301,   405,   152,  -301,  -301,   323,
-     632,  1257,   233,   407,   554,  -301,  -301,   233,  -301,   464,
-    -301,   215,   558,  -301,   233,  -301,   563,  -301,   131,   233,
-    -301,   686,   567,  -301,   272,  -301,  -301,  -301,   638,   299,
-    -301,   405,  -301,   323,  -301,  -301,  -301,  -301,  -301,   146,
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-    -301,  -301,  -301,  1257,  -301,  -301,   233,   233,  -301,   233,
-    -301,  -301,  1125,  -301,    28,   233,  -301,    38,   136,    38,
-    -301,  -301,  -301,     0,  -301,   405,  -301,   233,   181,   834,
-     233,   233,   582,   583,   182,     1,  -301,  -301,  -301,   233,
-    -301,  -301,  -301,  -301,   233
+     616,    -4,    91,   115,   122,    66,   194,   201,    72,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,    36,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,   244,   244,   244,   244,   244,
+     244,   244,  -240,   489,  -240,  -240,   844,   343,    25,  1131,
+     347,   557,   333,    -3,    37,    34,   257,  -240,  -240,   310,
+     291,  -240,   304,  -240,   495,   346,  -240,   220,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,    80,   640,   330,
+     703,  -240,   777,   152,  -240,  -240,  -240,  -240,   143,  -240,
+    -240,  -240,   278,   433,   212,   203,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,   964,   917,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,    41,  -240,   281,   163,
+     313,  -240,   290,   174,   326,   243,   362,  -240,  -240,  -240,
+    -240,  -240,   375,   359,  -240,   357,  -240,  -240,   387,    22,
+    -240,  -240,    32,  -240,   355,   179,   374,   295,   378,   200,
+     275,   183,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,   640,  -240,  -240,   777,   191,   564,  -240,  -240,  -240,
+    -240,   404,   244,   244,  -240,   440,   337,    63,  -240,     4,
+    -240,  -240,  -240,   244,   185,   123,   244,   244,   244,   244,
+     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
+     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
+     244,   244,   244,  1068,   244,   244,   244,  -240,  -240,  -240,
+    -240,  -240,  -240,  1190,   244,   294,   233,   305,  -240,  -240,
+    -240,   418,   244,  -240,   493,   350,  -240,   129,  -240,  -240,
+     206,     3,   167,   513,     8,  -240,    42,  -240,  -240,   388,
+     389,   394,   557,   257,   304,   464,   286,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,  -240,   124,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,   343,   557,   244,   244,   244,  -240,
+     712,   244,   514,  -240,   479,  -240,   413,   244,  -240,   544,
+    -240,  -240,  -240,  -240,   991,   244,   244,   244,  -240,  -240,
+    -240,  -240,  -240,   446,   244,   547,  -240,   491,  -240,   244,
+    -240,   766,  -240,  -240,  -240,  -240,   492,  -240,  -240,  -240,
+    -240,  -240,   481,  -240,    42,    42,  -240,  -240,  -240,  -240,
+     244,  -240,   384,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,   398,   244,  -240,  -240,  -240,   343,   208,   154,   353,
+    -240,  -240,   244,   552,   244,   244,  1190,   470,   343,    25,
+    -240,   244,   180,   160,   244,  -240,  -240,  -240,   244,   626,
+     244,   244,  1190,   618,   343,     3,   301,   227,   486,   921,
+    -240,    42,    56,  -240,  -240,   431,   638,    90,   437,   244,
+     347,   425,  -240,  -240,   244,  -240,   470,  -240,   181,   466,
+    -240,   244,  -240,   473,  -240,   160,   244,  -240,   692,   496,
+    -240,   441,   546,   487,   639,   311,   413,  -240,  -240,  -240,
+    -240,  -240,  -240,    42,  -240,   431,  -240,  -240,  -240,  -240,
+    -240,     3,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+    -240,  -240,  -240,  -240,  -240,   437,  -240,  -240,   244,   244,
+    -240,   244,  -240,  -240,  1131,  -240,    41,   244,  -240,  -240,
+     400,  -240,  -240,  -240,   558,    12,  -240,    42,  -240,     1,
+    -240,    42,  -240,   244,    13,   840,   244,   244,   333,   146,
+     333,  -240,  -240,     2,  -240,  -240,  -240,   244,   499,   540,
+     178,  -240,   244,  -240,  -240,  -240
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,  -301,
-      -1,   -21,  -301,   -51,  -301,  -301,  -301,  -301,  -301,   302,
-    -301,   264,  -301,  -301,     5,  -301,  -301,   217,  -301,   536,
-    -301,  -301,  -301,   245,  -301,  -301,   310,   269,  -301,  -301,
-     -45,   339,  -177,  -202,  -301,  -146,  -301,  -301,   211,  -301,
-     327,  -132,  -130,  -301,  -301,  -103,   667,  -301,   408,   543,
-     -48,   634,   -65,   -55,  -301,   430,  -301,   359,   267,  -301,
-    -300,  -301,   627,  -301,   293,  -190,  -301,   469,   588,   -35,
-    -301,  -301,   252,   -19,  -301,   377,  -301,   378,   -16,    -3
+    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
+       0,  -125,  -240,  -236,  -240,  -240,  -240,  -240,  -240,   168,
+    -240,   213,  -240,  -240,   -20,  -240,  -240,   -84,  -240,   483,
+    -240,  -240,  -240,   142,  -240,  -240,   249,   222,  -240,  -240,
+     -39,   241,  -165,  -232,  -240,  -126,  -240,  -240,   144,  -240,
+     272,  -110,  -106,  -240,  -240,   -91,   611,  -240,   391,   530,
+     -60,   630,   -38,   -42,  -240,   421,  -240,   354,   269,  -240,
+    -239,  -240,   632,  -240,   308,  -173,  -240,   482,   601,   -33,
+    -240,  -240,   267,   -17,  -240,   334,  -240,   335,   -16,   -18
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1055,334 +1055,324 @@ static const yytype_int16 yypgoto[] =
 #define YYTABLE_NINF -217
 static const yytype_int16 yytable[] =
 {
-      20,   149,   299,    39,   164,    40,    40,   376,    97,    29,
-      30,    31,    32,    33,    34,    35,   197,    53,   198,    40,
-      42,    43,    44,    45,    46,    47,    48,    40,    40,   200,
-      40,   187,   160,   -19,    40,   161,    49,    50,   286,   151,
-      56,    40,    40,    40,    19,   287,    64,    72,   -19,   303,
-     304,   152,    25,   435,   327,   -19,    37,   159,    38,    97,
-     404,   174,    21,   319,   177,    40,   179,   181,   182,   183,
-      51,   -19,   334,   332,   424,   361,   362,   363,   364,   365,
-     213,   506,   513,   184,   319,   432,   202,   167,   184,   203,
-     204,   208,   210,   302,  -191,   319,   214,   371,   371,   215,
-     216,   442,   217,   218,   219,   220,   221,   222,   223,   224,
-     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
-     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
-     245,   313,   384,   246,   247,   321,    40,   371,   278,   255,
-     279,   273,   200,   200,   256,   312,   162,   258,   262,   366,
-     367,   263,   268,   185,   400,   271,   343,    40,   186,   260,
-     291,   162,   296,   186,   301,   199,  -191,   372,  -109,  -151,
-    -109,   285,   373,   373,   361,   362,   363,   364,   365,    58,
-      59,    60,    61,    62,   307,   308,   265,    40,    40,   309,
-     310,   311,    89,   429,    98,   180,    40,    40,   152,   -19,
-     314,    40,    28,   317,    90,   145,   199,   -67,   320,   441,
-    -154,   322,   373,    40,    22,  -199,   480,    37,   163,   463,
-      58,    59,    60,    61,    62,    40,    23,   452,    40,   352,
-     269,    91,    41,   163,   -19,  -151,  -151,   357,    40,  -151,
-    -151,  -151,  -151,  -151,    99,    24,   270,   328,   417,   367,
-      26,   329,   330,   507,   324,   512,   351,   -70,   200,   325,
-     337,    92,   340,   345,   353,   -19,   342,   488,   306,   344,
-      27,   463,    97,   346,   347,   464,  -154,  -154,   211,   425,
-    -154,  -154,  -154,  -154,  -154,   358,  -199,  -199,  -199,   465,
-      40,   466,   499,   369,   212,   323,   370,   292,   188,   353,
-     -19,   374,   189,   353,   375,   282,   283,    37,    37,   201,
-     209,   292,    65,   143,   144,   379,    40,   381,   467,    37,
-     382,   261,   353,   385,   386,   426,    55,   464,    40,   415,
-     412,   388,   389,   390,   391,   454,   455,   157,   395,    97,
-     397,   465,   398,   466,   401,   199,   145,   407,    37,  -150,
-      97,   293,   143,   144,   274,   275,   416,   284,   358,    58,
-      59,    60,    61,    62,   353,   293,    97,   419,  -137,  -137,
-     467,   422,   423,  -137,   190,   191,   192,   427,   474,    37,
-     353,   267,   297,   199,    51,   145,   434,  -153,    40,   451,
-     447,   438,   450,   439,    40,   168,   335,    58,    59,    60,
-      61,    62,  -103,   176,   458,    40,   173,   -19,   494,    40,
-      49,    50,    40,   448,   -19,  -150,  -150,   453,   175,  -150,
-    -150,  -150,  -150,  -150,   476,    40,    37,   477,   272,   479,
-     143,   144,   169,    98,   482,    37,   170,   290,    37,   485,
-     295,   495,   487,   450,   489,   143,   144,   178,   143,   144,
-      37,   280,   300,  -153,  -153,   493,   205,  -153,  -153,  -153,
-    -153,  -153,   259,   145,  -210,   250,   264,   315,   -19,    58,
-      59,    60,    61,    62,   497,  -108,  -216,  -216,   145,  -216,
-    -216,   145,   500,    99,   281,   501,   171,   172,   188,   318,
-     504,   505,   189,     1,   338,     2,     3,     4,   509,     5,
-       6,     7,   341,   348,   430,     8,   354,   514,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,   355,  -216,  -216,  -210,  -210,  -210,  -205,   383,
-     252,  -216,   359,    40,  -216,   356,   380,   253,  -216,  -216,
-     103,   104,    37,   105,   106,    37,   406,   316,  -138,  -138,
-     -19,    40,   392,  -138,   190,   191,   192,   -19,   -19,    57,
-     396,    58,    59,    60,    61,    62,    63,    64,    37,    37,
-     339,   378,   107,   108,   109,   110,   111,   112,   113,   114,
-     115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
-     125,   126,   127,   128,   129,   130,   443,   131,    92,  -205,
-    -205,  -205,    37,   250,   394,   132,   444,    37,   133,   428,
-     445,   -19,   134,   135,  -216,  -216,   475,  -216,  -216,    57,
-     481,    58,    59,    60,    61,    62,    63,    64,   483,   486,
-    -187,   206,   194,   490,    58,    59,    60,    61,    62,   195,
-      37,   409,   440,    90,   510,   511,  -216,  -216,  -216,  -216,
+      16,   138,   286,   333,    86,   306,    32,    32,   175,    25,
+      26,    27,    28,    29,    30,    31,    61,    36,    37,    38,
+      39,    40,    41,    42,   279,   335,    87,   148,   154,   266,
+      32,   188,   185,    44,   186,   269,   270,    32,    87,   150,
+     151,    32,    32,   340,   341,   273,   -19,   150,   151,   149,
+      86,   162,   274,    53,   165,   368,   167,   169,   170,   171,
+     314,    32,    33,  -191,   306,   197,   199,    17,   146,   202,
+     147,    21,    24,   152,   146,   334,    88,   308,   280,   192,
+     193,   172,   504,   511,   -19,   505,   203,   271,    88,   204,
+     205,   363,   206,   207,   208,   209,   210,   211,   212,   213,
+     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
+     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
+     234,   299,   251,   235,   236,   363,   257,   411,    32,   244,
+     306,   444,   413,   265,   245,  -191,   377,   247,   267,   419,
+     344,   252,   345,   188,   188,   260,   300,   363,   278,   262,
+     283,   173,   288,   187,   333,   429,   174,  -151,   393,   430,
+     272,  -109,    18,  -109,   172,    32,   365,    47,    48,    49,
+      50,    51,    32,   294,   295,   254,   455,   304,   296,   297,
+     298,  -199,   472,    32,    32,    32,    19,   141,    32,   301,
+      32,   279,   187,    20,   311,   364,  -154,   422,   307,   312,
+     365,   309,   330,   416,   200,    32,    47,    48,    49,    50,
+      51,    32,   349,    32,   146,   490,   189,   -67,   401,   428,
+     201,   168,   365,  -151,  -151,   -19,   334,  -151,  -151,  -151,
+    -151,  -151,    32,   455,   134,   249,   327,   315,    32,   174,
+     337,   316,   317,   336,   258,   280,   -70,   339,   -19,    32,
+     324,   515,  -199,  -199,  -199,   293,   329,   310,   188,   331,
+     259,    86,  -154,  -154,   432,    22,  -154,  -154,  -154,  -154,
+    -154,   289,    23,   350,   146,   443,   321,   332,   156,   412,
+      32,   361,   456,   146,   362,   198,   371,   290,   291,   366,
+     371,   -19,   367,   353,   354,   355,   356,   357,   457,    32,
+      32,   495,   458,   372,   161,   374,    32,   319,   375,   371,
+      32,   378,   379,   487,   -19,   499,    32,   459,   322,   381,
+     382,   383,   384,   157,   484,   163,   388,   158,   390,   491,
+     391,   176,   394,    86,   140,   177,   132,   133,    32,   456,
+     396,   397,   132,   133,    78,    86,   141,   166,    32,   402,
+     194,   350,    32,   248,   176,   457,    79,   371,   177,   458,
+     405,    86,   253,   261,   409,   410,   284,   358,   359,   134,
+     414,   466,  -108,   371,   459,   134,   263,   159,   160,   371,
+     421,    54,   440,    80,   146,   425,   250,   426,   132,   133,
+     450,   353,   354,   355,   356,   357,   152,   146,   435,   256,
+     268,  -137,  -137,    32,   445,   302,  -137,   178,   179,   180,
+     305,  -103,   468,    81,   508,   469,   509,   471,   483,   325,
+     486,   134,   474,   328,  -138,  -138,   146,   477,   277,  -138,
+     178,   179,   180,  -187,   195,   486,    32,   333,   451,   132,
+     133,   132,   133,   446,   447,   146,    79,   282,   489,   146,
+      46,   287,    47,    48,    49,    50,    51,    52,    53,    54,
+      55,    56,    57,   346,   347,   403,   359,   493,    58,   348,
+    -210,   239,   134,    80,   134,   496,   152,   351,   497,   498,
+     373,   500,  -216,  -216,   146,  -216,  -216,   434,   503,   385,
+      43,   -19,   389,   395,   -19,   507,   164,   467,   -19,   -19,
+     -19,   -19,   510,    81,   146,  -187,   512,   -19,   398,   334,
+     417,   146,   479,   303,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   473,  -216,
+    -216,  -210,  -210,  -210,  -205,   376,   241,  -216,   475,    32,
+    -216,   480,   -19,   242,  -216,  -216,    92,    93,   481,    94,
+      95,   -19,    32,   501,   146,   187,   326,   437,   478,  -150,
+      46,   513,    47,    48,    49,    50,    51,    52,    53,    47,
+      48,    49,    50,    51,   146,   146,   338,   370,    96,    97,
+      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   119,   514,   120,    81,  -205,  -205,  -205,   146,   239,
+     387,   121,   465,   146,   122,   415,   255,   502,   123,   124,
+    -216,  -216,   424,  -216,  -216,  -150,  -150,   431,   506,  -150,
+    -150,  -150,  -150,  -150,     1,     2,     3,   476,     4,     5,
+       6,   420,   139,    46,     7,    47,    48,    49,    50,    51,
+      52,    53,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-      91,  -216,  -216,   -81,   -81,   -81,   473,   250,   252,  -216,
-     266,    37,  -216,   446,   491,   253,  -216,  -216,  -216,  -216,
-     437,  -216,  -216,    37,   502,   457,   503,   484,   420,   508,
-      92,    37,  -187,   433,   150,   196,   377,   288,   360,   418,
-     492,   207,   478,   331,   249,   496,   413,   414,     0,     0,
+    -216,  -216,  -216,  -216,  -216,  -216,   369,  -216,  -216,   -81,
+     -81,   -81,   275,   239,   241,  -216,   352,   146,  -216,   427,
+     184,   242,  -216,  -216,  -216,  -216,   404,  -216,  -216,   146,
+     146,   449,   482,   187,   488,   196,   182,  -153,    47,    48,
+      49,    50,    51,   183,   470,   318,   238,    47,    48,    49,
+      50,    51,   492,   441,   442,     0,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,     0,  -216,  -216,   -84,   -84,   -84,
-       0,   399,   252,  -216,     0,    40,  -216,     0,     0,   253,
-    -216,  -216,   103,   104,    40,   105,   106,     0,     0,     0,
-       0,     0,    57,     0,    58,    59,    60,    61,    62,    63,
-      64,    65,    66,    67,    68,     0,     0,     0,     0,     0,
-      69,     0,     0,     0,   107,   108,   109,   110,   111,   112,
-     113,   114,   115,   116,   117,   118,   119,   120,   121,   122,
-     123,   124,   125,   126,   127,   128,   129,   130,     0,   131,
-      92,   -85,   -85,   -85,     0,   250,     0,   132,     0,   -19,
-     133,     0,     0,     0,   134,   135,  -216,  -216,     0,  -216,
-    -216,   107,   108,   109,   110,   111,   112,   113,   114,   115,
-     116,   117,   118,   119,   120,   121,   122,   123,   124,   248,
-     126,   127,   128,     0,     0,     0,     0,     0,  -216,  -216,
+       0,  -216,  -216,   -84,   -84,   -84,     0,   392,   241,  -216,
+       0,    32,  -216,     0,     0,   242,  -216,  -216,    92,    93,
+       0,    94,    95,  -153,  -153,     0,     0,  -153,  -153,  -153,
+    -153,  -153,    47,    48,    49,    50,    51,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+      96,    97,    98,    99,   100,   101,   102,   103,   104,   105,
+     106,   107,   108,   109,   110,   111,   112,   113,   114,   115,
+     116,   117,   118,   119,     0,   120,    81,   -85,   -85,   -85,
+       0,   239,     0,   121,     0,   -19,   122,     0,     0,    32,
+     123,   124,  -216,  -216,     0,  -216,  -216,    46,     0,    47,
+      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
+       0,     0,     0,     0,     0,    58,     0,     0,     0,     0,
+       0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,  -216,
+    -216,     0,     0,     0,     0,   -19,   241,  -216,   239,     0,
+    -216,    -2,   436,   242,  -216,  -216,     0,     0,     0,  -216,
+    -216,     0,  -216,  -216,    46,     0,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,     0,     0,     0,
+       0,     0,    58,     0,     0,     0,     0,     0,     0,     0,
+     152,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,     0,  -216,  -216,     0,     0,     0,     0,   -19,
-     252,  -216,   250,     0,  -216,    -2,   408,   253,  -216,  -216,
-       0,     0,     0,  -216,  -216,     0,  -216,  -216,    57,     0,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      68,     0,     0,     0,     0,     0,    69,     0,     0,     0,
-       0,     0,     0,     0,    51,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,     0,  -216,  -216,     0,   240,
+       0,     0,   239,   241,  -216,     0,     0,  -216,     0,     0,
+     242,  -216,  -216,  -216,  -216,     0,  -216,  -216,    96,    97,
+      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   237,   115,   116,   117,
+       0,     0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,
-    -216,  -216,     0,   251,     0,     0,   250,   252,  -216,     0,
-       0,  -216,     0,     0,   253,  -216,  -216,  -216,  -216,     0,
-    -216,  -216,     0,     0,     0,     0,     0,     0,     0,     0,
+    -216,  -216,     0,     0,     0,     0,   380,   241,  -216,   313,
+       0,  -216,     0,    32,   242,  -216,  -216,     0,     0,     0,
+      92,    93,     0,    94,    95,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,     0,  -216,  -216,     0,     0,     0,     0,
-     387,   252,  -216,   326,     0,  -216,     0,    40,   253,  -216,
-    -216,     0,     0,     0,   103,   104,     0,   105,   106,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
-     121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
-      40,   131,    92,     0,     0,     0,     0,   103,   104,   132,
-     105,   106,   133,     0,     0,     0,   134,   135,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,   127,
-     128,   129,   130,     0,   131,    92,   103,   104,     0,   105,
-     106,     0,   132,     0,     0,   133,     0,     0,     0,   134,
-     135,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   107,   108,
-     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
-     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
-     129,   130,     0,   131,    92,     0,     0,   162,   459,     0,
-       0,   132,     0,     0,   133,     0,     0,     0,   134,   135,
-      57,     0,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    68,     0,     0,     0,     0,     0,    69,     0,
-       0,     0,     0,     0,     0,     0,    51,     0,     0,     0,
+       0,     0,    96,    97,    98,    99,   100,   101,   102,   103,
+     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
+     114,   115,   116,   117,   118,   119,    32,   120,    81,     0,
+       0,     0,     0,    92,    93,   121,    94,    95,   122,     0,
+       0,     0,   123,   124,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,    96,    97,    98,    99,   100,
+     101,   102,   103,   104,   105,   106,   107,   108,   109,   110,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,     0,
+     120,    81,    92,    93,     0,    94,    95,     0,   121,     0,
+       0,   122,     0,     0,     0,   123,   124,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   163
+       0,     0,     0,     0,    96,    97,    98,    99,   100,   101,
+     102,   103,   104,   105,   106,   107,   108,   109,   110,   111,
+     112,   113,   114,   115,   116,   117,   118,   119,     0,   120,
+      81,     0,     0,     0,     0,     0,     0,   121,     0,     0,
+     122,     0,     0,     0,   123,   124
 };
 
 static const yytype_int16 yycheck[] =
 {
-       1,    46,   179,    19,    55,     5,     5,   307,    43,    10,
-      11,    12,    13,    14,    15,    16,    81,    36,    83,     5,
-      21,    22,    23,    24,    25,    26,    27,     5,     5,    84,
-       5,    79,    53,     5,     5,    54,     5,     6,    13,     1,
-      41,     5,     5,     5,     1,    20,    21,    42,     5,    12,
-      13,    13,     5,    17,   244,    12,    71,    52,    73,    94,
-      37,    62,    71,     1,    65,     5,    67,    68,    69,    70,
-      39,    43,    43,    13,   374,     7,     8,     9,    10,    11,
-      96,    81,    81,     1,     1,   385,    89,    73,     1,    90,
-      91,    94,    95,    71,     0,     1,    97,     1,     1,   100,
-     101,   401,   103,   104,   105,   106,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
-     121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
-     131,   196,   322,   134,   135,    73,     5,     1,   159,   140,
-     161,   157,   197,   198,   145,   193,     0,   148,   151,    81,
-      82,   152,   155,    71,   344,   156,    73,     5,    76,    72,
-     176,     0,   178,    76,   180,     1,    72,    71,    71,     5,
-      73,   172,    76,    76,     7,     8,     9,    10,    11,    15,
-      16,    17,    18,    19,   185,   186,     1,     5,     5,   190,
-     191,   192,     1,   383,    13,     1,     5,     5,    13,     5,
-     201,     5,     0,   206,    13,    74,     1,    71,   209,   399,
-       5,   212,    76,     5,    71,     0,     1,    71,    72,   421,
-      15,    16,    17,    18,    19,     5,    71,    75,     5,   280,
-       1,    40,    12,    72,     5,    71,    72,   285,     5,    75,
-      76,    77,    78,    79,    63,    71,    17,   248,    81,    82,
-      71,   252,   253,    72,    71,    73,   277,    72,   313,    76,
-     261,    70,   265,    71,   280,    71,   267,   444,    72,   270,
-      71,   473,   307,   274,   275,   421,    71,    72,     1,    71,
-      75,    76,    77,    78,    79,   286,    71,    72,    73,   421,
-       5,   421,   482,   294,    17,    72,   297,    12,     1,   315,
-      71,   302,     5,   319,   305,    13,    14,    71,    71,    73,
-      73,    12,    22,    41,    42,   316,     5,   318,   421,    71,
-     321,    73,   338,   324,   325,   376,     1,   473,     5,   350,
-     349,   332,   333,   334,   335,    12,    13,     1,   339,   374,
-     341,   473,   343,   473,   345,     1,    74,   348,    71,     5,
-     385,    66,    41,    42,    35,    36,   357,    65,   359,    15,
-      16,    17,    18,    19,   380,    66,   401,   368,    71,    72,
-     473,   372,   373,    76,    77,    78,    79,   378,   423,    71,
-     396,    73,    71,     1,    39,    74,   387,     5,     5,   410,
-     406,   392,   408,   394,     5,    21,    13,    15,    16,    17,
-      18,    19,    13,     1,   420,     5,    13,     5,   459,     5,
-       5,     6,     5,    13,    12,    71,    72,   418,    21,    75,
-      76,    77,    78,    79,   425,     5,    71,   428,    73,   430,
-      41,    42,    13,    13,   435,    71,    17,    73,    71,   440,
-      73,   462,   443,   459,   445,    41,    42,     1,    41,    42,
-      71,     1,    73,    71,    72,   456,    72,    75,    76,    77,
-      78,    79,    72,    74,     0,     1,    72,     1,    66,    15,
-      16,    17,    18,    19,   475,    71,    12,    13,    74,    15,
-      16,    74,   483,    63,    13,   486,    67,    68,     1,    73,
-     491,   492,     5,    26,     1,    28,    29,    30,   499,    32,
-      33,    34,    73,    27,    40,    38,    75,   508,    44,    45,
+       0,    40,   167,     0,    37,     1,     5,     5,    68,     9,
+      10,    11,    12,    13,    14,    15,    36,    17,    18,    19,
+      20,    21,    22,    23,    12,   261,    13,    43,    45,   154,
+       5,    73,    70,    33,    72,    13,    14,     5,    13,     5,
+       6,     5,     5,    35,    36,    13,     5,     5,     6,    12,
+      83,    51,    20,    21,    54,   294,    56,    57,    58,    59,
+     233,     5,    26,     0,     1,    83,    84,    71,    71,    85,
+      73,     5,     0,    39,    71,    72,    63,    73,    66,    79,
+      80,     1,    81,    81,    43,    72,    86,    65,    63,    89,
+      90,     1,    92,    93,    94,    95,    96,    97,    98,    99,
+     100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
+     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
+     120,   181,   140,   123,   124,     1,   144,   366,     5,   129,
+       1,    75,   368,   153,   134,    72,   309,   137,   155,   378,
+     265,   141,   267,   185,   186,   145,   184,     1,   164,   149,
+     166,    71,   168,     1,     0,   394,    76,     5,   331,   395,
+     160,    71,    71,    73,     1,     5,    76,    15,    16,    17,
+      18,    19,     5,   173,   174,     1,   408,   195,   178,   179,
+     180,     0,     1,     5,     5,     5,    71,    13,     5,   189,
+       5,    12,     1,    71,    71,    71,     5,    17,   198,    76,
+      76,   201,    73,   376,     1,     5,    15,    16,    17,    18,
+      19,     5,   272,     5,    71,   451,    73,    71,   343,   392,
+      17,     1,    76,    71,    72,     5,    72,    75,    76,    77,
+      78,    79,     5,   465,    74,    72,   254,   237,     5,    76,
+      73,   241,   242,   261,     1,    66,    72,   263,     5,     5,
+     250,    73,    71,    72,    73,    72,   256,    72,   300,   259,
+      17,   294,    71,    72,    37,    71,    75,    76,    77,    78,
+      79,    71,    71,   273,    71,   400,    43,    71,    21,    71,
+       5,   281,   408,    71,   284,    73,   302,    12,    13,   289,
+     306,    71,   292,     7,     8,     9,    10,    11,   408,     5,
+       5,   474,   408,   303,    13,   305,     5,    13,   308,   325,
+       5,   311,   312,   438,    71,   480,     5,   408,    13,   319,
+     320,   321,   322,    13,    13,    21,   326,    17,   328,   454,
+     330,     1,   332,   366,     1,     5,    41,    42,     5,   465,
+     340,   341,    41,    42,     1,   378,    13,     1,     5,   349,
+      72,   351,     5,    72,     1,   465,    13,   373,     5,   465,
+     360,   394,    72,     1,   364,   365,    71,    81,    82,    74,
+     370,   410,    71,   389,   465,    74,     1,    67,    68,   395,
+     380,    22,   399,    40,    71,   385,    73,   387,    41,    42,
+     406,     7,     8,     9,    10,    11,    39,    71,   398,    73,
+      13,    71,    72,     5,   404,     1,    76,    77,    78,    79,
+      73,    13,   412,    70,   498,   415,   500,   417,   434,     1,
+     436,    74,   422,    73,    71,    72,    71,   427,    73,    76,
+      77,    78,    79,     0,     1,   451,     5,     0,     1,    41,
+      42,    41,    42,    12,    13,    71,    13,    73,   448,    71,
+      13,    73,    15,    16,    17,    18,    19,    20,    21,    22,
+      23,    24,    25,    75,    75,    81,    82,   467,    31,    75,
+       0,     1,    74,    40,    74,   475,    39,    13,   478,   479,
+       1,   481,    12,    13,    71,    15,    16,     1,   488,    43,
+       1,     5,     1,     1,     5,   495,     1,    72,    12,    13,
+       5,    12,   502,    70,    71,    72,   506,    12,    27,    72,
+      40,    71,    71,    73,    44,    45,    46,    47,    48,    49,
+      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    72,    69,
+      70,    71,    72,    73,     0,     1,    76,    77,    75,     5,
+      80,     5,    66,    83,    84,    85,    12,    13,    71,    15,
+      16,    66,     5,     5,    71,     1,    73,   399,    72,     5,
+      13,    72,    15,    16,    17,    18,    19,    20,    21,    15,
+      16,    17,    18,    19,    71,    71,    73,    73,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    75,    69,    70,    71,    72,    73,     0,     1,
-      76,    77,    13,     5,    80,    75,     1,    83,    84,    85,
-      12,    13,    71,    15,    16,    71,     1,    73,    71,    72,
-       5,     5,    43,    76,    77,    78,    79,    12,    13,    13,
-       1,    15,    16,    17,    18,    19,    20,    21,    71,    71,
-      73,    73,    44,    45,    46,    47,    48,    49,    50,    51,
+      66,    67,    72,    69,    70,    71,    72,    73,    71,     1,
+      73,    77,   409,    71,    80,    73,   143,   485,    84,    85,
+      12,    13,   383,    15,    16,    71,    72,   396,   494,    75,
+      76,    77,    78,    79,    28,    29,    30,   425,    32,    33,
+      34,   379,    41,    13,    38,    15,    16,    17,    18,    19,
+      20,    21,    44,    45,    46,    47,    48,    49,    50,    51,
       52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,    71,    69,    70,    71,
-      72,    73,    71,     1,    73,    77,     5,    71,    80,    73,
-      71,    66,    84,    85,    12,    13,    72,    15,    16,    13,
-      72,    15,    16,    17,    18,    19,    20,    21,    75,    72,
-       0,     1,    13,     5,    15,    16,    17,    18,    19,    20,
-      71,   349,    73,    13,    72,    72,    44,    45,    46,    47,
+      62,    63,    64,    65,    66,    67,   295,    69,    70,    71,
+      72,    73,   162,     1,    76,    77,   275,    71,    80,    73,
+      70,    83,    84,    85,    12,    13,   352,    15,    16,    71,
+      71,    73,    73,     1,   445,    83,    13,     5,    15,    16,
+      17,    18,    19,    20,   416,   243,   125,    15,    16,    17,
+      18,    19,   465,   399,   399,    -1,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
       58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      40,    69,    70,    71,    72,    73,   422,     1,    76,    77,
-     154,    71,    80,    73,   449,    83,    84,    85,    12,    13,
-     390,    15,    16,    71,   487,    73,   489,   438,   369,   498,
-      70,    71,    72,   386,    47,    81,   308,   174,   288,   360,
-     453,    94,   429,   254,   136,   473,   349,   349,    -1,    -1,
+      -1,    69,    70,    71,    72,    73,    -1,     1,    76,    77,
+      -1,     5,    80,    -1,    -1,    83,    84,    85,    12,    13,
+      -1,    15,    16,    71,    72,    -1,    -1,    75,    76,    77,
+      78,    79,    15,    16,    17,    18,    19,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
       54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
       64,    65,    66,    67,    -1,    69,    70,    71,    72,    73,
-      -1,     1,    76,    77,    -1,     5,    80,    -1,    -1,    83,
-      84,    85,    12,    13,     5,    15,    16,    -1,    -1,    -1,
-      -1,    -1,    13,    -1,    15,    16,    17,    18,    19,    20,
-      21,    22,    23,    24,    25,    -1,    -1,    -1,    -1,    -1,
-      31,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
+      -1,     1,    -1,    77,    -1,     5,    80,    -1,    -1,     5,
+      84,    85,    12,    13,    -1,    15,    16,    13,    -1,    15,
+      16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
+      -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
       50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
       60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
-      70,    71,    72,    73,    -1,     1,    -1,    77,    -1,     5,
-      80,    -1,    -1,    -1,    84,    85,    12,    13,    -1,    15,
-      16,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,    -1,
+      80,     0,     1,    83,    84,    85,    -1,    -1,    -1,    12,
+      13,    -1,    15,    16,    13,    -1,    15,    16,    17,    18,
+      19,    20,    21,    22,    23,    24,    25,    -1,    -1,    -1,
+      -1,    -1,    31,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      39,    44,    45,    46,    47,    48,    49,    50,    51,    52,
       53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,    -1,    -1,    -1,    -1,    -1,    44,    45,
+      63,    64,    65,    66,    67,    -1,    69,    70,    -1,    72,
+      -1,    -1,     1,    76,    77,    -1,    -1,    80,    -1,    -1,
+      83,    84,    85,    12,    13,    -1,    15,    16,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    -1,    69,    70,    -1,    -1,    -1,    -1,    75,
-      76,    77,     1,    -1,    80,     0,     1,    83,    84,    85,
-      -1,    -1,    -1,    12,    13,    -1,    15,    16,    13,    -1,
-      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
-      25,    -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    39,    44,    45,    46,    47,    48,
+      -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
       49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
       59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
-      69,    70,    -1,    72,    -1,    -1,     1,    76,    77,    -1,
-      -1,    80,    -1,    -1,    83,    84,    85,    12,    13,    -1,
-      15,    16,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      69,    70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,
+      -1,    80,    -1,     5,    83,    84,    85,    -1,    -1,    -1,
+      12,    13,    -1,    15,    16,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,
-      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    -1,    69,    70,    -1,    -1,    -1,    -1,
-      75,    76,    77,     1,    -1,    80,    -1,     5,    83,    84,
-      85,    -1,    -1,    -1,    12,    13,    -1,    15,    16,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    44,    45,    46,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
+      62,    63,    64,    65,    66,    67,     5,    69,    70,    -1,
+      -1,    -1,    -1,    12,    13,    77,    15,    16,    80,    -1,
+      -1,    -1,    84,    85,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-       5,    69,    70,    -1,    -1,    -1,    -1,    12,    13,    77,
-      15,    16,    80,    -1,    -1,    -1,    84,    85,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,
-      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    -1,    69,    70,    12,    13,    -1,    15,
-      16,    -1,    77,    -1,    -1,    80,    -1,    -1,    -1,    84,
-      85,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    -1,    69,    70,    -1,    -1,     0,     1,    -1,
-      -1,    77,    -1,    -1,    80,    -1,    -1,    -1,    84,    85,
-      13,    -1,    15,    16,    17,    18,    19,    20,    21,    22,
-      23,    24,    25,    -1,    -1,    -1,    -1,    -1,    31,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    39,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
+      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
+      69,    70,    12,    13,    -1,    15,    16,    -1,    77,    -1,
+      -1,    80,    -1,    -1,    -1,    84,    85,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    72
+      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
+      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
+      70,    -1,    -1,    -1,    -1,    -1,    -1,    77,    -1,    -1,
+      80,    -1,    -1,    -1,    84,    85
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,    26,    28,    29,    30,    32,    33,    34,    38,    87,
-      89,    90,    91,    92,    93,    94,    95,    98,   100,     1,
-      96,    71,    71,    71,    71,     5,    71,    71,     0,    96,
-      96,    96,    96,    96,    96,    96,    97,    71,    73,   174,
-       5,    12,    96,    96,    96,    96,    96,    96,    96,     5,
-       6,    39,   101,   169,   170,     1,    96,    13,    15,    16,
-      17,    18,    19,    20,    21,    22,    23,    24,    25,    31,
-      88,   105,   110,   129,   131,   137,   138,   141,   142,   143,
-     144,   145,   146,   147,   148,   149,   150,   152,   155,     1,
-      13,    40,    70,   156,   157,   158,   159,   165,    13,    63,
-     134,   135,   136,    12,    13,    15,    16,    44,    45,    46,
-      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
-      67,    69,    77,    80,    84,    85,   140,   161,   163,   164,
-     165,   166,   167,    41,    42,    74,   122,   123,   125,   126,
-     142,     1,    13,   113,   114,   115,   116,     1,   102,   110,
-      97,   169,     0,    72,    99,   174,   175,    73,    21,    13,
-      17,    67,    68,    13,    96,    21,     1,    96,     1,    96,
-       1,    96,    96,    96,     1,    71,    76,   146,     1,     5,
-      77,    78,    79,   139,    13,    20,   147,   148,   148,     1,
-     149,    73,   175,    96,    96,    72,     1,   158,   175,    73,
-     175,     1,    17,   174,    96,    96,    96,    96,    96,    96,
+       0,    28,    29,    30,    32,    33,    34,    38,    87,    89,
+      90,    91,    92,    93,    94,    95,    96,    71,    71,    71,
+      71,     5,    71,    71,     0,    96,    96,    96,    96,    96,
+      96,    96,     5,    26,    98,   100,    96,    96,    96,    96,
+      96,    96,    96,     1,    96,    97,    13,    15,    16,    17,
+      18,    19,    20,    21,    22,    23,    24,    25,    31,    88,
+     105,   110,   129,   131,   137,   138,   141,   142,   143,   144,
+     145,   146,   147,   148,   149,   150,   152,   155,     1,    13,
+      40,    70,   156,   157,   158,   159,   165,    13,    63,   134,
+     135,   136,    12,    13,    15,    16,    44,    45,    46,    47,
+      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
+      69,    77,    80,    84,    85,   140,   161,   163,   164,   165,
+     166,   167,    41,    42,    74,   122,   123,   125,   126,   142,
+       1,    13,   113,   114,   115,   116,    71,    73,   174,    12,
+       5,     6,    39,   101,   169,   170,    21,    13,    17,    67,
+      68,    13,    96,    21,     1,    96,     1,    96,     1,    96,
+      96,    96,     1,    71,    76,   146,     1,     5,    77,    78,
+      79,   139,    13,    20,   147,   148,   148,     1,   149,    73,
+     174,   175,    96,    96,    72,     1,   158,   175,    73,   175,
+       1,    17,   174,    96,    96,    96,    96,    96,    96,    96,
       96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
       96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    96,    62,   164,
-       1,    72,    76,    83,   162,    96,    96,    96,    96,    72,
-      72,    73,   175,    96,    72,     1,   115,    73,   175,     1,
-      17,    96,    73,   174,    35,    36,   103,   111,    97,    97,
-       1,    13,    13,    14,    65,    96,    13,    20,   145,   151,
-      73,   174,    12,    66,   119,    73,   174,    71,   126,   128,
-      73,   174,    71,    12,    13,   132,    72,    96,    96,    96,
-      96,    96,   146,   148,    96,     1,    73,   175,    73,     1,
-      96,    73,    96,    72,    71,    76,     1,   161,    96,    96,
-      96,   163,    13,   120,    43,    13,   130,    96,     1,    73,
-     175,    73,    96,    73,    96,    71,    96,    96,    27,   104,
-     117,    97,    99,   174,    75,    75,    75,   146,    96,    13,
-     151,     7,     8,     9,    10,    11,    81,    82,   153,    96,
-      96,     1,    71,    76,    96,    96,   156,   144,    73,    96,
-       1,    96,    96,     1,   161,    96,    96,    75,    96,    96,
-      96,    96,    43,   124,    73,    96,     1,    96,    96,     1,
-     161,    96,   127,   128,    37,   112,     1,    96,     1,   105,
-     106,   110,   169,   171,   173,    97,    96,    81,   153,    96,
-     127,   107,    96,    96,   156,    71,    99,    96,    73,   161,
-      40,   160,   156,   136,    96,    17,   121,   122,    96,    96,
-      73,   161,   156,    71,     5,    71,    73,   174,    13,   118,
-     174,    97,    75,    96,    12,    13,   154,    73,   174,     1,
-      99,   108,   109,   129,   131,   137,   138,   141,   168,   169,
-     171,   172,   173,   107,   126,    72,    96,    96,   160,    96,
-       1,    72,    96,    75,   123,    96,    72,    96,   128,    96,
-       5,   119,   154,    96,    99,    97,   168,    96,   133,   161,
-      96,    96,   113,   113,    96,    96,    81,    72,   134,    96,
-      72,    72,    73,    81,    96
+      96,    96,    96,    96,    96,    96,    96,    62,   164,     1,
+      72,    76,    83,   162,    96,    96,    96,    96,    72,    72,
+      73,   175,    96,    72,     1,   115,    73,   175,     1,    17,
+      96,     1,    96,     1,   102,   110,    97,   169,    13,    13,
+      14,    65,    96,    13,    20,   145,   151,    73,   174,    12,
+      66,   119,    73,   174,    71,   126,   128,    73,   174,    71,
+      12,    13,   132,    72,    96,    96,    96,    96,    96,   146,
+     148,    96,     1,    73,   175,    73,     1,    96,    73,    96,
+      72,    71,    76,     1,   161,    96,    96,    96,   163,    13,
+     120,    43,    13,   130,    96,     1,    73,   175,    73,    96,
+      73,    96,    71,     0,    72,    99,   175,    73,    73,   174,
+      35,    36,   103,   111,    97,    97,    75,    75,    75,   146,
+      96,    13,   151,     7,     8,     9,    10,    11,    81,    82,
+     153,    96,    96,     1,    71,    76,    96,    96,   156,   144,
+      73,   174,    96,     1,    96,    96,     1,   161,    96,    96,
+      75,    96,    96,    96,    96,    43,   124,    73,    96,     1,
+      96,    96,     1,   161,    96,     1,    96,    96,    27,   104,
+     117,    97,    96,    81,   153,    96,   127,   128,   107,    96,
+      96,   156,    71,    99,    96,    73,   161,    40,   160,   156,
+     136,    96,    17,   121,   122,    96,    96,    73,   161,   156,
+      99,   127,    37,   112,     1,    96,     1,   105,   106,   110,
+     169,   171,   173,    97,    75,    96,    12,    13,   154,    73,
+     174,     1,    99,   108,   109,   129,   131,   137,   138,   141,
+     168,   169,   171,   172,   173,   107,   126,    72,    96,    96,
+     160,    96,     1,    72,    96,    75,   123,    96,    72,    71,
+       5,    71,    73,   174,    13,   118,   174,    97,   154,    96,
+      99,    97,   168,    96,   133,   161,    96,    96,    96,   128,
+      96,     5,   119,    96,    81,    72,   134,    96,   113,   113,
+      96,    81,    96,    72,    72,    73
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -3907,7 +3897,7 @@ yyreduce:
 
 
 /* Line 1267 of yacc.c.  */
-#line 3911 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 3901 "WebCore/tmp/../generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index d4e26cc..8780c36 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -241,25 +241,25 @@ findProp (register const char *str, register unsigned int len)
       {"zoom", CSSPropertyZoom},
 #line 23 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 266 "CSSPropertyNames.gperf"
+#line 267 "CSSPropertyNames.gperf"
       {"marker", CSSPropertyMarker},
 #line 24 "CSSPropertyNames.gperf"
       {"border-bottom", CSSPropertyBorderBottom},
-#line 268 "CSSPropertyNames.gperf"
+#line 269 "CSSPropertyNames.gperf"
       {"marker-mid", CSSPropertyMarkerMid},
-#line 79 "CSSPropertyNames.gperf"
+#line 78 "CSSPropertyNames.gperf"
       {"margin", CSSPropertyMargin},
 #line 285 "CSSPropertyNames.gperf"
       {"kerning", CSSPropertyKerning},
-#line 267 "CSSPropertyNames.gperf"
+#line 268 "CSSPropertyNames.gperf"
       {"marker-end", CSSPropertyMarkerEnd},
-#line 80 "CSSPropertyNames.gperf"
+#line 79 "CSSPropertyNames.gperf"
       {"margin-bottom", CSSPropertyMarginBottom},
-#line 250 "CSSPropertyNames.gperf"
+#line 251 "CSSPropertyNames.gperf"
       {"mask", CSSPropertyMask},
-#line 271 "CSSPropertyNames.gperf"
+#line 272 "CSSPropertyNames.gperf"
       {"stroke", CSSPropertyStroke},
-#line 112 "CSSPropertyNames.gperf"
+#line 111 "CSSPropertyNames.gperf"
       {"size", CSSPropertySize},
 #line 144 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
@@ -267,115 +267,115 @@ findProp (register const char *str, register unsigned int len)
       {"writing-mode", CSSPropertyWritingMode},
 #line 162 "CSSPropertyNames.gperf"
       {"-webkit-binding", CSSPropertyWebkitBinding},
-#line 110 "CSSPropertyNames.gperf"
+#line 109 "CSSPropertyNames.gperf"
       {"resize", CSSPropertyResize},
-#line 265 "CSSPropertyNames.gperf"
+#line 266 "CSSPropertyNames.gperf"
       {"image-rendering", CSSPropertyImageRendering},
 #line 149 "CSSPropertyNames.gperf"
       {"-webkit-animation", CSSPropertyWebkitAnimation},
 #line 165 "CSSPropertyNames.gperf"
       {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 204 "CSSPropertyNames.gperf"
+#line 205 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
 #line 136 "CSSPropertyNames.gperf"
       {"top", CSSPropertyTop},
 #line 142 "CSSPropertyNames.gperf"
       {"widows", CSSPropertyWidows},
-#line 269 "CSSPropertyNames.gperf"
+#line 270 "CSSPropertyNames.gperf"
       {"marker-start", CSSPropertyMarkerStart},
 #line 154 "CSSPropertyNames.gperf"
       {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
-#line 103 "CSSPropertyNames.gperf"
+#line 102 "CSSPropertyNames.gperf"
       {"page", CSSPropertyPage},
-#line 209 "CSSPropertyNames.gperf"
+#line 210 "CSSPropertyNames.gperf"
       {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
 #line 43 "CSSPropertyNames.gperf"
       {"border-top", CSSPropertyBorderTop},
-#line 98 "CSSPropertyNames.gperf"
+#line 97 "CSSPropertyNames.gperf"
       {"padding", CSSPropertyPadding},
-#line 239 "CSSPropertyNames.gperf"
+#line 240 "CSSPropertyNames.gperf"
       {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 210 "CSSPropertyNames.gperf"
+#line 211 "CSSPropertyNames.gperf"
       {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 99 "CSSPropertyNames.gperf"
+#line 98 "CSSPropertyNames.gperf"
       {"padding-bottom", CSSPropertyPaddingBottom},
-#line 83 "CSSPropertyNames.gperf"
+#line 82 "CSSPropertyNames.gperf"
       {"margin-top", CSSPropertyMarginTop},
-#line 196 "CSSPropertyNames.gperf"
+#line 197 "CSSPropertyNames.gperf"
       {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
-#line 56 "CSSPropertyNames.gperf"
+#line 55 "CSSPropertyNames.gperf"
       {"content", CSSPropertyContent},
-#line 108 "CSSPropertyNames.gperf"
+#line 107 "CSSPropertyNames.gperf"
       {"position", CSSPropertyPosition},
-#line 60 "CSSPropertyNames.gperf"
+#line 59 "CSSPropertyNames.gperf"
       {"direction", CSSPropertyDirection},
-#line 217 "CSSPropertyNames.gperf"
+#line 218 "CSSPropertyNames.gperf"
       {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 113 "CSSPropertyNames.gperf"
+#line 112 "CSSPropertyNames.gperf"
       {"src", CSSPropertySrc},
 #line 146 "CSSPropertyNames.gperf"
       {"word-wrap", CSSPropertyWordWrap},
-#line 219 "CSSPropertyNames.gperf"
+#line 220 "CSSPropertyNames.gperf"
       {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 106 "CSSPropertyNames.gperf"
+#line 105 "CSSPropertyNames.gperf"
       {"page-break-inside", CSSPropertyPageBreakInside},
-#line 214 "CSSPropertyNames.gperf"
+#line 215 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 102 "CSSPropertyNames.gperf"
+#line 101 "CSSPropertyNames.gperf"
       {"padding-top", CSSPropertyPaddingTop},
-#line 220 "CSSPropertyNames.gperf"
+#line 221 "CSSPropertyNames.gperf"
       {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
 #line 151 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 211 "CSSPropertyNames.gperf"
+#line 212 "CSSPropertyNames.gperf"
       {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 192 "CSSPropertyNames.gperf"
+#line 193 "CSSPropertyNames.gperf"
       {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 276 "CSSPropertyNames.gperf"
+#line 277 "CSSPropertyNames.gperf"
       {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 225 "CSSPropertyNames.gperf"
+#line 226 "CSSPropertyNames.gperf"
       {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 275 "CSSPropertyNames.gperf"
+#line 276 "CSSPropertyNames.gperf"
       {"stroke-linejoin", CSSPropertyStrokeLinejoin},
 #line 282 "CSSPropertyNames.gperf"
       {"dominant-baseline", CSSPropertyDominantBaseline},
-#line 52 "CSSPropertyNames.gperf"
+#line 51 "CSSPropertyNames.gperf"
       {"caption-side", CSSPropertyCaptionSide},
-#line 107 "CSSPropertyNames.gperf"
+#line 106 "CSSPropertyNames.gperf"
       {"pointer-events", CSSPropertyPointerEvents},
-#line 55 "CSSPropertyNames.gperf"
+#line 54 "CSSPropertyNames.gperf"
       {"color", CSSPropertyColor},
 #line 41 "CSSPropertyNames.gperf"
       {"border-spacing", CSSPropertyBorderSpacing},
-#line 53 "CSSPropertyNames.gperf"
+#line 52 "CSSPropertyNames.gperf"
       {"clear", CSSPropertyClear},
 #line 36 "CSSPropertyNames.gperf"
       {"border-radius", CSSPropertyBorderRadius},
-#line 109 "CSSPropertyNames.gperf"
+#line 108 "CSSPropertyNames.gperf"
       {"quotes", CSSPropertyQuotes},
 #line 145 "CSSPropertyNames.gperf"
       {"word-spacing", CSSPropertyWordSpacing},
 #line 31 "CSSPropertyNames.gperf"
       {"border-color", CSSPropertyBorderColor},
-#line 198 "CSSPropertyNames.gperf"
+#line 199 "CSSPropertyNames.gperf"
       {"-webkit-marquee", CSSPropertyWebkitMarquee},
 #line 25 "CSSPropertyNames.gperf"
       {"border-bottom-color", CSSPropertyBorderBottomColor},
 #line 152 "CSSPropertyNames.gperf"
       {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
-#line 244 "CSSPropertyNames.gperf"
+#line 245 "CSSPropertyNames.gperf"
       {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
 #line 166 "CSSPropertyNames.gperf"
       {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 208 "CSSPropertyNames.gperf"
+#line 209 "CSSPropertyNames.gperf"
       {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 261 "CSSPropertyNames.gperf"
+#line 262 "CSSPropertyNames.gperf"
       {"color-rendering", CSSPropertyColorRendering},
 #line 137 "CSSPropertyNames.gperf"
       {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 54 "CSSPropertyNames.gperf"
+#line 53 "CSSPropertyNames.gperf"
       {"clip", CSSPropertyClip},
-#line 241 "CSSPropertyNames.gperf"
+#line 242 "CSSPropertyNames.gperf"
       {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
 #line 157 "CSSPropertyNames.gperf"
       {"-webkit-appearance", CSSPropertyWebkitAppearance},
@@ -383,9 +383,9 @@ findProp (register const char *str, register unsigned int len)
       {"background", CSSPropertyBackground},
 #line 138 "CSSPropertyNames.gperf"
       {"unicode-range", CSSPropertyUnicodeRange},
-#line 59 "CSSPropertyNames.gperf"
+#line 58 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 90 "CSSPropertyNames.gperf"
+#line 89 "CSSPropertyNames.gperf"
       {"outline", CSSPropertyOutline},
 #line 14 "CSSPropertyNames.gperf"
       {"background-image", CSSPropertyBackgroundImage},
@@ -393,171 +393,171 @@ findProp (register const char *str, register unsigned int len)
       {"border-top-color", CSSPropertyBorderTopColor},
 #line 15 "CSSPropertyNames.gperf"
       {"background-origin", CSSPropertyBackgroundOrigin},
-#line 58 "CSSPropertyNames.gperf"
+#line 57 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 256 "CSSPropertyNames.gperf"
+#line 257 "CSSPropertyNames.gperf"
       {"stop-color", CSSPropertyStopColor},
 #line 280 "CSSPropertyNames.gperf"
       {"alignment-baseline", CSSPropertyAlignmentBaseline},
 #line 22 "CSSPropertyNames.gperf"
       {"background-size", CSSPropertyBackgroundSize},
-#line 201 "CSSPropertyNames.gperf"
+#line 202 "CSSPropertyNames.gperf"
       {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
-#line 274 "CSSPropertyNames.gperf"
+#line 275 "CSSPropertyNames.gperf"
       {"stroke-linecap", CSSPropertyStrokeLinecap},
 #line 161 "CSSPropertyNames.gperf"
       {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
-#line 73 "CSSPropertyNames.gperf"
+#line 72 "CSSPropertyNames.gperf"
       {"letter-spacing", CSSPropertyLetterSpacing},
-#line 202 "CSSPropertyNames.gperf"
+#line 203 "CSSPropertyNames.gperf"
       {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 207 "CSSPropertyNames.gperf"
+#line 208 "CSSPropertyNames.gperf"
       {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
 #line 153 "CSSPropertyNames.gperf"
       {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 199 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
 #line 200 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
+#line 201 "CSSPropertyNames.gperf"
       {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
 #line 19 "CSSPropertyNames.gperf"
       {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 221 "CSSPropertyNames.gperf"
+#line 222 "CSSPropertyNames.gperf"
       {"-webkit-perspective", CSSPropertyWebkitPerspective},
-#line 111 "CSSPropertyNames.gperf"
+#line 110 "CSSPropertyNames.gperf"
       {"right", CSSPropertyRight},
-#line 57 "CSSPropertyNames.gperf"
+#line 56 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
 #line 143 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
 #line 16 "CSSPropertyNames.gperf"
       {"background-position", CSSPropertyBackgroundPosition},
-#line 87 "CSSPropertyNames.gperf"
+#line 86 "CSSPropertyNames.gperf"
       {"min-width", CSSPropertyMinWidth},
-#line 222 "CSSPropertyNames.gperf"
+#line 223 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
 #line 37 "CSSPropertyNames.gperf"
       {"border-right", CSSPropertyBorderRight},
 #line 49 "CSSPropertyNames.gperf"
       {"border-width", CSSPropertyBorderWidth},
-#line 64 "CSSPropertyNames.gperf"
+#line 63 "CSSPropertyNames.gperf"
       {"font", CSSPropertyFont},
-#line 82 "CSSPropertyNames.gperf"
+#line 81 "CSSPropertyNames.gperf"
       {"margin-right", CSSPropertyMarginRight},
 #line 29 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 251 "CSSPropertyNames.gperf"
+#line 252 "CSSPropertyNames.gperf"
       {"enable-background", CSSPropertyEnableBackground},
-#line 278 "CSSPropertyNames.gperf"
+#line 279 "CSSPropertyNames.gperf"
       {"stroke-width", CSSPropertyStrokeWidth},
-#line 188 "CSSPropertyNames.gperf"
+#line 189 "CSSPropertyNames.gperf"
       {"-webkit-columns", CSSPropertyWebkitColumns},
-#line 193 "CSSPropertyNames.gperf"
+#line 194 "CSSPropertyNames.gperf"
       {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 258 "CSSPropertyNames.gperf"
+#line 259 "CSSPropertyNames.gperf"
       {"color-interpolation", CSSPropertyColorInterpolation},
 #line 163 "CSSPropertyNames.gperf"
       {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 66 "CSSPropertyNames.gperf"
+#line 65 "CSSPropertyNames.gperf"
       {"font-size", CSSPropertyFontSize},
 #line 30 "CSSPropertyNames.gperf"
       {"border-collapse", CSSPropertyBorderCollapse},
-#line 117 "CSSPropertyNames.gperf"
+#line 116 "CSSPropertyNames.gperf"
       {"text-indent", CSSPropertyTextIndent},
 #line 147 "CSSPropertyNames.gperf"
       {"z-index", CSSPropertyZIndex},
 #line 139 "CSSPropertyNames.gperf"
       {"vertical-align", CSSPropertyVerticalAlign},
-#line 180 "CSSPropertyNames.gperf"
+#line 181 "CSSPropertyNames.gperf"
       {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 101 "CSSPropertyNames.gperf"
+#line 100 "CSSPropertyNames.gperf"
       {"padding-right", CSSPropertyPaddingRight},
-#line 246 "CSSPropertyNames.gperf"
+#line 247 "CSSPropertyNames.gperf"
       {"-webkit-user-select", CSSPropertyWebkitUserSelect},
 #line 48 "CSSPropertyNames.gperf"
       {"border-top-width", CSSPropertyBorderTopWidth},
-#line 279 "CSSPropertyNames.gperf"
+#line 128 "CSSPropertyNames.gperf"
       {"text-rendering", CSSPropertyTextRendering},
-#line 89 "CSSPropertyNames.gperf"
+#line 88 "CSSPropertyNames.gperf"
       {"orphans", CSSPropertyOrphans},
 #line 174 "CSSPropertyNames.gperf"
       {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
-#line 233 "CSSPropertyNames.gperf"
+#line 234 "CSSPropertyNames.gperf"
       {"-webkit-transform", CSSPropertyWebkitTransform},
-#line 182 "CSSPropertyNames.gperf"
+#line 183 "CSSPropertyNames.gperf"
       {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 195 "CSSPropertyNames.gperf"
+#line 196 "CSSPropertyNames.gperf"
       {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
 #line 160 "CSSPropertyNames.gperf"
       {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 194 "CSSPropertyNames.gperf"
+#line 195 "CSSPropertyNames.gperf"
       {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
 #line 13 "CSSPropertyNames.gperf"
       {"background-color", CSSPropertyBackgroundColor},
-#line 230 "CSSPropertyNames.gperf"
+#line 231 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 270 "CSSPropertyNames.gperf"
+#line 271 "CSSPropertyNames.gperf"
       {"shape-rendering", CSSPropertyShapeRendering},
-#line 105 "CSSPropertyNames.gperf"
+#line 104 "CSSPropertyNames.gperf"
       {"page-break-before", CSSPropertyPageBreakBefore},
-#line 234 "CSSPropertyNames.gperf"
+#line 235 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 104 "CSSPropertyNames.gperf"
+#line 103 "CSSPropertyNames.gperf"
       {"page-break-after", CSSPropertyPageBreakAfter},
-#line 91 "CSSPropertyNames.gperf"
+#line 90 "CSSPropertyNames.gperf"
       {"outline-color", CSSPropertyOutlineColor},
-#line 206 "CSSPropertyNames.gperf"
+#line 207 "CSSPropertyNames.gperf"
       {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 177 "CSSPropertyNames.gperf"
+#line 178 "CSSPropertyNames.gperf"
       {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
-#line 72 "CSSPropertyNames.gperf"
+#line 71 "CSSPropertyNames.gperf"
       {"left", CSSPropertyLeft},
-#line 237 "CSSPropertyNames.gperf"
+#line 238 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
-#line 69 "CSSPropertyNames.gperf"
+#line 68 "CSSPropertyNames.gperf"
       {"font-variant", CSSPropertyFontVariant},
-#line 63 "CSSPropertyNames.gperf"
+#line 62 "CSSPropertyNames.gperf"
       {"float", CSSPropertyFloat},
-#line 252 "CSSPropertyNames.gperf"
+#line 253 "CSSPropertyNames.gperf"
       {"filter", CSSPropertyFilter},
 #line 32 "CSSPropertyNames.gperf"
       {"border-left", CSSPropertyBorderLeft},
-#line 205 "CSSPropertyNames.gperf"
+#line 206 "CSSPropertyNames.gperf"
       {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 116 "CSSPropertyNames.gperf"
+#line 115 "CSSPropertyNames.gperf"
       {"text-decoration", CSSPropertyTextDecoration},
-#line 81 "CSSPropertyNames.gperf"
+#line 80 "CSSPropertyNames.gperf"
       {"margin-left", CSSPropertyMarginLeft},
 #line 12 "CSSPropertyNames.gperf"
       {"background-clip", CSSPropertyBackgroundClip},
-#line 197 "CSSPropertyNames.gperf"
+#line 198 "CSSPropertyNames.gperf"
       {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
 #line 167 "CSSPropertyNames.gperf"
       {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 249 "CSSPropertyNames.gperf"
+#line 250 "CSSPropertyNames.gperf"
       {"clip-rule", CSSPropertyClipRule},
 #line 169 "CSSPropertyNames.gperf"
       {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
 #line 141 "CSSPropertyNames.gperf"
       {"white-space", CSSPropertyWhiteSpace},
-#line 115 "CSSPropertyNames.gperf"
+#line 114 "CSSPropertyNames.gperf"
       {"text-align", CSSPropertyTextAlign},
-#line 215 "CSSPropertyNames.gperf"
+#line 216 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
 #line 159 "CSSPropertyNames.gperf"
       {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
-#line 216 "CSSPropertyNames.gperf"
+#line 217 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
 #line 168 "CSSPropertyNames.gperf"
       {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 212 "CSSPropertyNames.gperf"
+#line 213 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
-#line 100 "CSSPropertyNames.gperf"
+#line 99 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
-#line 189 "CSSPropertyNames.gperf"
+#line 190 "CSSPropertyNames.gperf"
       {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
 #line 27 "CSSPropertyNames.gperf"
       {"border-bottom-right-radius", CSSPropertyBorderBottomRightRadius},
-#line 88 "CSSPropertyNames.gperf"
+#line 87 "CSSPropertyNames.gperf"
       {"opacity", CSSPropertyOpacity},
 #line 38 "CSSPropertyNames.gperf"
       {"border-right-color", CSSPropertyBorderRightColor},
@@ -567,61 +567,61 @@ findProp (register const char *str, register unsigned int len)
       {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 42 "CSSPropertyNames.gperf"
       {"border-style", CSSPropertyBorderStyle},
-#line 213 "CSSPropertyNames.gperf"
+#line 214 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 95 "CSSPropertyNames.gperf"
+#line 94 "CSSPropertyNames.gperf"
       {"overflow", CSSPropertyOverflow},
 #line 28 "CSSPropertyNames.gperf"
       {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 262 "CSSPropertyNames.gperf"
+#line 263 "CSSPropertyNames.gperf"
       {"fill", CSSPropertyFill},
 #line 150 "CSSPropertyNames.gperf"
       {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 277 "CSSPropertyNames.gperf"
+#line 278 "CSSPropertyNames.gperf"
       {"stroke-opacity", CSSPropertyStrokeOpacity},
-#line 124 "CSSPropertyNames.gperf"
+#line 123 "CSSPropertyNames.gperf"
       {"text-overline", CSSPropertyTextOverline},
-#line 181 "CSSPropertyNames.gperf"
+#line 182 "CSSPropertyNames.gperf"
       {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 126 "CSSPropertyNames.gperf"
+#line 125 "CSSPropertyNames.gperf"
       {"text-overline-mode", CSSPropertyTextOverlineMode},
 #line 46 "CSSPropertyNames.gperf"
       {"border-top-right-radius", CSSPropertyBorderTopRightRadius},
-#line 240 "CSSPropertyNames.gperf"
+#line 241 "CSSPropertyNames.gperf"
       {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
-#line 61 "CSSPropertyNames.gperf"
+#line 60 "CSSPropertyNames.gperf"
       {"display", CSSPropertyDisplay},
-#line 94 "CSSPropertyNames.gperf"
+#line 93 "CSSPropertyNames.gperf"
       {"outline-width", CSSPropertyOutlineWidth},
-#line 242 "CSSPropertyNames.gperf"
+#line 243 "CSSPropertyNames.gperf"
       {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
 #line 47 "CSSPropertyNames.gperf"
       {"border-top-style", CSSPropertyBorderTopStyle},
-#line 183 "CSSPropertyNames.gperf"
+#line 184 "CSSPropertyNames.gperf"
       {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
 #line 140 "CSSPropertyNames.gperf"
       {"visibility", CSSPropertyVisibility},
-#line 248 "CSSPropertyNames.gperf"
+#line 249 "CSSPropertyNames.gperf"
       {"clip-path", CSSPropertyClipPath},
-#line 257 "CSSPropertyNames.gperf"
+#line 258 "CSSPropertyNames.gperf"
       {"stop-opacity", CSSPropertyStopOpacity},
-#line 247 "CSSPropertyNames.gperf"
+#line 248 "CSSPropertyNames.gperf"
       {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 229 "CSSPropertyNames.gperf"
+#line 230 "CSSPropertyNames.gperf"
       {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 231 "CSSPropertyNames.gperf"
+#line 232 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
-#line 255 "CSSPropertyNames.gperf"
+#line 256 "CSSPropertyNames.gperf"
       {"lighting-color", CSSPropertyLightingColor},
-#line 71 "CSSPropertyNames.gperf"
+#line 70 "CSSPropertyNames.gperf"
       {"height", CSSPropertyHeight},
-#line 253 "CSSPropertyNames.gperf"
+#line 254 "CSSPropertyNames.gperf"
       {"flood-color", CSSPropertyFloodColor},
 #line 156 "CSSPropertyNames.gperf"
       {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
 #line 131 "CSSPropertyNames.gperf"
       {"text-underline", CSSPropertyTextUnderline},
-#line 86 "CSSPropertyNames.gperf"
+#line 85 "CSSPropertyNames.gperf"
       {"min-height", CSSPropertyMinHeight},
 #line 155 "CSSPropertyNames.gperf"
       {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
@@ -633,23 +633,23 @@ findProp (register const char *str, register unsigned int len)
       {"background-attachment", CSSPropertyBackgroundAttachment},
 #line 33 "CSSPropertyNames.gperf"
       {"border-left-color", CSSPropertyBorderLeftColor},
-#line 75 "CSSPropertyNames.gperf"
+#line 74 "CSSPropertyNames.gperf"
       {"list-style", CSSPropertyListStyle},
 #line 164 "CSSPropertyNames.gperf"
       {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 243 "CSSPropertyNames.gperf"
+#line 244 "CSSPropertyNames.gperf"
       {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
-#line 76 "CSSPropertyNames.gperf"
+#line 75 "CSSPropertyNames.gperf"
       {"list-style-image", CSSPropertyListStyleImage},
 #line 40 "CSSPropertyNames.gperf"
       {"border-right-width", CSSPropertyBorderRightWidth},
-#line 187 "CSSPropertyNames.gperf"
+#line 188 "CSSPropertyNames.gperf"
       {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
 #line 20 "CSSPropertyNames.gperf"
       {"background-repeat-x", CSSPropertyBackgroundRepeatX},
-#line 70 "CSSPropertyNames.gperf"
+#line 69 "CSSPropertyNames.gperf"
       {"font-weight", CSSPropertyFontWeight},
-#line 260 "CSSPropertyNames.gperf"
+#line 261 "CSSPropertyNames.gperf"
       {"color-profile", CSSPropertyColorProfile},
 #line 45 "CSSPropertyNames.gperf"
       {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
@@ -657,139 +657,139 @@ findProp (register const char *str, register unsigned int len)
       {"background-repeat-y", CSSPropertyBackgroundRepeatY},
 #line 17 "CSSPropertyNames.gperf"
       {"background-position-x", CSSPropertyBackgroundPositionX},
-#line 85 "CSSPropertyNames.gperf"
+#line 84 "CSSPropertyNames.gperf"
       {"max-width", CSSPropertyMaxWidth},
-#line 223 "CSSPropertyNames.gperf"
+#line 224 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
-#line 179 "CSSPropertyNames.gperf"
+#line 180 "CSSPropertyNames.gperf"
       {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
-#line 178 "CSSPropertyNames.gperf"
+#line 179 "CSSPropertyNames.gperf"
       {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
 #line 18 "CSSPropertyNames.gperf"
       {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 190 "CSSPropertyNames.gperf"
+#line 191 "CSSPropertyNames.gperf"
       {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
 #line 173 "CSSPropertyNames.gperf"
       {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 203 "CSSPropertyNames.gperf"
+#line 204 "CSSPropertyNames.gperf"
       {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 224 "CSSPropertyNames.gperf"
+#line 225 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
-#line 51 "CSSPropertyNames.gperf"
-      {"box-shadow", CSSPropertyBoxShadow},
 #line 129 "CSSPropertyNames.gperf"
       {"text-shadow", CSSPropertyTextShadow},
-#line 74 "CSSPropertyNames.gperf"
+#line 73 "CSSPropertyNames.gperf"
       {"line-height", CSSPropertyLineHeight},
-#line 77 "CSSPropertyNames.gperf"
+#line 76 "CSSPropertyNames.gperf"
       {"list-style-position", CSSPropertyListStylePosition},
-#line 114 "CSSPropertyNames.gperf"
+#line 113 "CSSPropertyNames.gperf"
       {"table-layout", CSSPropertyTableLayout},
-#line 125 "CSSPropertyNames.gperf"
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
+#line 124 "CSSPropertyNames.gperf"
       {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 62 "CSSPropertyNames.gperf"
+#line 61 "CSSPropertyNames.gperf"
       {"empty-cells", CSSPropertyEmptyCells},
-#line 232 "CSSPropertyNames.gperf"
+#line 233 "CSSPropertyNames.gperf"
       {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
 #line 130 "CSSPropertyNames.gperf"
       {"text-transform", CSSPropertyTextTransform},
-#line 67 "CSSPropertyNames.gperf"
+#line 66 "CSSPropertyNames.gperf"
       {"font-stretch", CSSPropertyFontStretch},
-#line 93 "CSSPropertyNames.gperf"
+#line 92 "CSSPropertyNames.gperf"
       {"outline-style", CSSPropertyOutlineStyle},
 #line 286 "CSSPropertyNames.gperf"
       {"text-anchor", CSSPropertyTextAnchor},
-#line 184 "CSSPropertyNames.gperf"
+#line 185 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 272 "CSSPropertyNames.gperf"
+#line 273 "CSSPropertyNames.gperf"
       {"stroke-dasharray", CSSPropertyStrokeDasharray},
 #line 35 "CSSPropertyNames.gperf"
       {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 264 "CSSPropertyNames.gperf"
+#line 265 "CSSPropertyNames.gperf"
       {"fill-rule", CSSPropertyFillRule},
-#line 235 "CSSPropertyNames.gperf"
+#line 236 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
 #line 281 "CSSPropertyNames.gperf"
       {"baseline-shift", CSSPropertyBaselineShift},
 #line 132 "CSSPropertyNames.gperf"
       {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 236 "CSSPropertyNames.gperf"
+#line 237 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 259 "CSSPropertyNames.gperf"
+#line 260 "CSSPropertyNames.gperf"
       {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
 #line 39 "CSSPropertyNames.gperf"
       {"border-right-style", CSSPropertyBorderRightStyle},
-#line 68 "CSSPropertyNames.gperf"
+#line 67 "CSSPropertyNames.gperf"
       {"font-style", CSSPropertyFontStyle},
-#line 128 "CSSPropertyNames.gperf"
+#line 127 "CSSPropertyNames.gperf"
       {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 96 "CSSPropertyNames.gperf"
+#line 95 "CSSPropertyNames.gperf"
       {"overflow-x", CSSPropertyOverflowX},
-#line 123 "CSSPropertyNames.gperf"
+#line 122 "CSSPropertyNames.gperf"
       {"text-overflow", CSSPropertyTextOverflow},
 #line 176 "CSSPropertyNames.gperf"
       {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 245 "CSSPropertyNames.gperf"
+#line 246 "CSSPropertyNames.gperf"
       {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 186 "CSSPropertyNames.gperf"
+#line 187 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
-#line 97 "CSSPropertyNames.gperf"
+#line 96 "CSSPropertyNames.gperf"
       {"overflow-y", CSSPropertyOverflowY},
-#line 238 "CSSPropertyNames.gperf"
+#line 239 "CSSPropertyNames.gperf"
       {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
-#line 92 "CSSPropertyNames.gperf"
+#line 91 "CSSPropertyNames.gperf"
       {"outline-offset", CSSPropertyOutlineOffset},
 #line 135 "CSSPropertyNames.gperf"
       {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 254 "CSSPropertyNames.gperf"
+#line 255 "CSSPropertyNames.gperf"
       {"flood-opacity", CSSPropertyFloodOpacity},
 #line 34 "CSSPropertyNames.gperf"
       {"border-left-style", CSSPropertyBorderLeftStyle},
-#line 84 "CSSPropertyNames.gperf"
+#line 83 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 228 "CSSPropertyNames.gperf"
+#line 229 "CSSPropertyNames.gperf"
       {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 191 "CSSPropertyNames.gperf"
+#line 192 "CSSPropertyNames.gperf"
       {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 263 "CSSPropertyNames.gperf"
+#line 264 "CSSPropertyNames.gperf"
       {"fill-opacity", CSSPropertyFillOpacity},
-#line 273 "CSSPropertyNames.gperf"
+#line 274 "CSSPropertyNames.gperf"
       {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
-#line 127 "CSSPropertyNames.gperf"
+#line 126 "CSSPropertyNames.gperf"
       {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 78 "CSSPropertyNames.gperf"
+#line 77 "CSSPropertyNames.gperf"
       {"list-style-type", CSSPropertyListStyleType},
-#line 218 "CSSPropertyNames.gperf"
+#line 219 "CSSPropertyNames.gperf"
       {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 185 "CSSPropertyNames.gperf"
+#line 186 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
 #line 158 "CSSPropertyNames.gperf"
       {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
-#line 227 "CSSPropertyNames.gperf"
+#line 228 "CSSPropertyNames.gperf"
       {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
 #line 134 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
 #line 284 "CSSPropertyNames.gperf"
       {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 65 "CSSPropertyNames.gperf"
+#line 64 "CSSPropertyNames.gperf"
       {"font-family", CSSPropertyFontFamily},
 #line 170 "CSSPropertyNames.gperf"
       {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
-#line 118 "CSSPropertyNames.gperf"
+#line 117 "CSSPropertyNames.gperf"
       {"text-line-through", CSSPropertyTextLineThrough},
-#line 120 "CSSPropertyNames.gperf"
+#line 119 "CSSPropertyNames.gperf"
       {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 226 "CSSPropertyNames.gperf"
+#line 227 "CSSPropertyNames.gperf"
       {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
 #line 283 "CSSPropertyNames.gperf"
       {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
 #line 171 "CSSPropertyNames.gperf"
       {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
-#line 119 "CSSPropertyNames.gperf"
+#line 118 "CSSPropertyNames.gperf"
       {"text-line-through-color", CSSPropertyTextLineThroughColor},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
 #line 121 "CSSPropertyNames.gperf"
+      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
+#line 120 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
 
@@ -869,9 +869,9 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1, 208,  -1, 209,  -1, 210,  -1,  -1, 211,
        -1,  -1,  -1, 212,  -1,  -1,  -1, 213,  -1,  -1,
        -1, 214,  -1,  -1,  -1,  -1, 215, 216,  -1,  -1,
-      217, 218,  -1, 219,  -1, 220, 221,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 222,  -1,  -1, 223,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 224,  -1, 225,
+      217, 218,  -1, 219,  -1,  -1, 220,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 221,  -1,  -1, 222,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 223, 224, 225,
        -1, 226,  -1,  -1,  -1, 227,  -1,  -1,  -1, 228,
        -1,  -1, 229,  -1,  -1,  -1,  -1,  -1, 230,  -1,
        -1, 231,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1042,7 +1042,6 @@ static const char * const propertyNameStrings[278] = {
 "border-top-width",
 "border-width",
 "bottom",
-"box-shadow",
 "caption-side",
 "clear",
 "clip",
@@ -1120,6 +1119,7 @@ static const char * const propertyNameStrings[278] = {
 "text-overline-mode",
 "text-overline-style",
 "text-overline-width",
+"text-rendering",
 "text-shadow",
 "text-transform",
 "text-underline",
@@ -1168,6 +1168,7 @@ static const char * const propertyNameStrings[278] = {
 "-webkit-box-orient",
 "-webkit-box-pack",
 "-webkit-box-reflect",
+"-webkit-box-shadow",
 "-webkit-box-sizing",
 "-webkit-column-break-after",
 "-webkit-column-break-before",
@@ -1270,7 +1271,6 @@ static const char * const propertyNameStrings[278] = {
 "stroke-miterlimit",
 "stroke-opacity",
 "stroke-width",
-"text-rendering",
 "alignment-baseline",
 "baseline-shift",
 "dominant-baseline",
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index 9af7f73..f1332e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -46,84 +46,84 @@ enum CSSPropertyID {
     CSSPropertyBorderTopWidth = 1039,
     CSSPropertyBorderWidth = 1040,
     CSSPropertyBottom = 1041,
-    CSSPropertyBoxShadow = 1042,
-    CSSPropertyCaptionSide = 1043,
-    CSSPropertyClear = 1044,
-    CSSPropertyClip = 1045,
-    CSSPropertyColor = 1046,
-    CSSPropertyContent = 1047,
-    CSSPropertyCounterIncrement = 1048,
-    CSSPropertyCounterReset = 1049,
-    CSSPropertyCursor = 1050,
-    CSSPropertyDirection = 1051,
-    CSSPropertyDisplay = 1052,
-    CSSPropertyEmptyCells = 1053,
-    CSSPropertyFloat = 1054,
-    CSSPropertyFont = 1055,
-    CSSPropertyFontFamily = 1056,
-    CSSPropertyFontSize = 1057,
-    CSSPropertyFontStretch = 1058,
-    CSSPropertyFontStyle = 1059,
-    CSSPropertyFontVariant = 1060,
-    CSSPropertyFontWeight = 1061,
-    CSSPropertyHeight = 1062,
-    CSSPropertyLeft = 1063,
-    CSSPropertyLetterSpacing = 1064,
-    CSSPropertyLineHeight = 1065,
-    CSSPropertyListStyle = 1066,
-    CSSPropertyListStyleImage = 1067,
-    CSSPropertyListStylePosition = 1068,
-    CSSPropertyListStyleType = 1069,
-    CSSPropertyMargin = 1070,
-    CSSPropertyMarginBottom = 1071,
-    CSSPropertyMarginLeft = 1072,
-    CSSPropertyMarginRight = 1073,
-    CSSPropertyMarginTop = 1074,
-    CSSPropertyMaxHeight = 1075,
-    CSSPropertyMaxWidth = 1076,
-    CSSPropertyMinHeight = 1077,
-    CSSPropertyMinWidth = 1078,
-    CSSPropertyOpacity = 1079,
-    CSSPropertyOrphans = 1080,
-    CSSPropertyOutline = 1081,
-    CSSPropertyOutlineColor = 1082,
-    CSSPropertyOutlineOffset = 1083,
-    CSSPropertyOutlineStyle = 1084,
-    CSSPropertyOutlineWidth = 1085,
-    CSSPropertyOverflow = 1086,
-    CSSPropertyOverflowX = 1087,
-    CSSPropertyOverflowY = 1088,
-    CSSPropertyPadding = 1089,
-    CSSPropertyPaddingBottom = 1090,
-    CSSPropertyPaddingLeft = 1091,
-    CSSPropertyPaddingRight = 1092,
-    CSSPropertyPaddingTop = 1093,
-    CSSPropertyPage = 1094,
-    CSSPropertyPageBreakAfter = 1095,
-    CSSPropertyPageBreakBefore = 1096,
-    CSSPropertyPageBreakInside = 1097,
-    CSSPropertyPointerEvents = 1098,
-    CSSPropertyPosition = 1099,
-    CSSPropertyQuotes = 1100,
-    CSSPropertyResize = 1101,
-    CSSPropertyRight = 1102,
-    CSSPropertySize = 1103,
-    CSSPropertySrc = 1104,
-    CSSPropertyTableLayout = 1105,
-    CSSPropertyTextAlign = 1106,
-    CSSPropertyTextDecoration = 1107,
-    CSSPropertyTextIndent = 1108,
-    CSSPropertyTextLineThrough = 1109,
-    CSSPropertyTextLineThroughColor = 1110,
-    CSSPropertyTextLineThroughMode = 1111,
-    CSSPropertyTextLineThroughStyle = 1112,
-    CSSPropertyTextLineThroughWidth = 1113,
-    CSSPropertyTextOverflow = 1114,
-    CSSPropertyTextOverline = 1115,
-    CSSPropertyTextOverlineColor = 1116,
-    CSSPropertyTextOverlineMode = 1117,
-    CSSPropertyTextOverlineStyle = 1118,
-    CSSPropertyTextOverlineWidth = 1119,
+    CSSPropertyCaptionSide = 1042,
+    CSSPropertyClear = 1043,
+    CSSPropertyClip = 1044,
+    CSSPropertyColor = 1045,
+    CSSPropertyContent = 1046,
+    CSSPropertyCounterIncrement = 1047,
+    CSSPropertyCounterReset = 1048,
+    CSSPropertyCursor = 1049,
+    CSSPropertyDirection = 1050,
+    CSSPropertyDisplay = 1051,
+    CSSPropertyEmptyCells = 1052,
+    CSSPropertyFloat = 1053,
+    CSSPropertyFont = 1054,
+    CSSPropertyFontFamily = 1055,
+    CSSPropertyFontSize = 1056,
+    CSSPropertyFontStretch = 1057,
+    CSSPropertyFontStyle = 1058,
+    CSSPropertyFontVariant = 1059,
+    CSSPropertyFontWeight = 1060,
+    CSSPropertyHeight = 1061,
+    CSSPropertyLeft = 1062,
+    CSSPropertyLetterSpacing = 1063,
+    CSSPropertyLineHeight = 1064,
+    CSSPropertyListStyle = 1065,
+    CSSPropertyListStyleImage = 1066,
+    CSSPropertyListStylePosition = 1067,
+    CSSPropertyListStyleType = 1068,
+    CSSPropertyMargin = 1069,
+    CSSPropertyMarginBottom = 1070,
+    CSSPropertyMarginLeft = 1071,
+    CSSPropertyMarginRight = 1072,
+    CSSPropertyMarginTop = 1073,
+    CSSPropertyMaxHeight = 1074,
+    CSSPropertyMaxWidth = 1075,
+    CSSPropertyMinHeight = 1076,
+    CSSPropertyMinWidth = 1077,
+    CSSPropertyOpacity = 1078,
+    CSSPropertyOrphans = 1079,
+    CSSPropertyOutline = 1080,
+    CSSPropertyOutlineColor = 1081,
+    CSSPropertyOutlineOffset = 1082,
+    CSSPropertyOutlineStyle = 1083,
+    CSSPropertyOutlineWidth = 1084,
+    CSSPropertyOverflow = 1085,
+    CSSPropertyOverflowX = 1086,
+    CSSPropertyOverflowY = 1087,
+    CSSPropertyPadding = 1088,
+    CSSPropertyPaddingBottom = 1089,
+    CSSPropertyPaddingLeft = 1090,
+    CSSPropertyPaddingRight = 1091,
+    CSSPropertyPaddingTop = 1092,
+    CSSPropertyPage = 1093,
+    CSSPropertyPageBreakAfter = 1094,
+    CSSPropertyPageBreakBefore = 1095,
+    CSSPropertyPageBreakInside = 1096,
+    CSSPropertyPointerEvents = 1097,
+    CSSPropertyPosition = 1098,
+    CSSPropertyQuotes = 1099,
+    CSSPropertyResize = 1100,
+    CSSPropertyRight = 1101,
+    CSSPropertySize = 1102,
+    CSSPropertySrc = 1103,
+    CSSPropertyTableLayout = 1104,
+    CSSPropertyTextAlign = 1105,
+    CSSPropertyTextDecoration = 1106,
+    CSSPropertyTextIndent = 1107,
+    CSSPropertyTextLineThrough = 1108,
+    CSSPropertyTextLineThroughColor = 1109,
+    CSSPropertyTextLineThroughMode = 1110,
+    CSSPropertyTextLineThroughStyle = 1111,
+    CSSPropertyTextLineThroughWidth = 1112,
+    CSSPropertyTextOverflow = 1113,
+    CSSPropertyTextOverline = 1114,
+    CSSPropertyTextOverlineColor = 1115,
+    CSSPropertyTextOverlineMode = 1116,
+    CSSPropertyTextOverlineStyle = 1117,
+    CSSPropertyTextOverlineWidth = 1118,
+    CSSPropertyTextRendering = 1119,
     CSSPropertyTextShadow = 1120,
     CSSPropertyTextTransform = 1121,
     CSSPropertyTextUnderline = 1122,
@@ -172,109 +172,109 @@ enum CSSPropertyID {
     CSSPropertyWebkitBoxOrient = 1165,
     CSSPropertyWebkitBoxPack = 1166,
     CSSPropertyWebkitBoxReflect = 1167,
-    CSSPropertyWebkitBoxSizing = 1168,
-    CSSPropertyWebkitColumnBreakAfter = 1169,
-    CSSPropertyWebkitColumnBreakBefore = 1170,
-    CSSPropertyWebkitColumnBreakInside = 1171,
-    CSSPropertyWebkitColumnCount = 1172,
-    CSSPropertyWebkitColumnGap = 1173,
-    CSSPropertyWebkitColumnRule = 1174,
-    CSSPropertyWebkitColumnRuleColor = 1175,
-    CSSPropertyWebkitColumnRuleStyle = 1176,
-    CSSPropertyWebkitColumnRuleWidth = 1177,
-    CSSPropertyWebkitColumnWidth = 1178,
-    CSSPropertyWebkitColumns = 1179,
-    CSSPropertyWebkitFontSizeDelta = 1180,
-    CSSPropertyWebkitFontSmoothing = 1181,
-    CSSPropertyWebkitHighlight = 1182,
-    CSSPropertyWebkitLineBreak = 1183,
-    CSSPropertyWebkitLineClamp = 1184,
-    CSSPropertyWebkitMarginBottomCollapse = 1185,
-    CSSPropertyWebkitMarginCollapse = 1186,
-    CSSPropertyWebkitMarginStart = 1187,
-    CSSPropertyWebkitMarginTopCollapse = 1188,
-    CSSPropertyWebkitMarquee = 1189,
-    CSSPropertyWebkitMarqueeDirection = 1190,
-    CSSPropertyWebkitMarqueeIncrement = 1191,
-    CSSPropertyWebkitMarqueeRepetition = 1192,
-    CSSPropertyWebkitMarqueeSpeed = 1193,
-    CSSPropertyWebkitMarqueeStyle = 1194,
-    CSSPropertyWebkitMask = 1195,
-    CSSPropertyWebkitMaskAttachment = 1196,
-    CSSPropertyWebkitMaskBoxImage = 1197,
-    CSSPropertyWebkitMaskClip = 1198,
-    CSSPropertyWebkitMaskComposite = 1199,
-    CSSPropertyWebkitMaskImage = 1200,
-    CSSPropertyWebkitMaskOrigin = 1201,
-    CSSPropertyWebkitMaskPosition = 1202,
-    CSSPropertyWebkitMaskPositionX = 1203,
-    CSSPropertyWebkitMaskPositionY = 1204,
-    CSSPropertyWebkitMaskRepeat = 1205,
-    CSSPropertyWebkitMaskRepeatX = 1206,
-    CSSPropertyWebkitMaskRepeatY = 1207,
-    CSSPropertyWebkitMaskSize = 1208,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1209,
-    CSSPropertyWebkitNbspMode = 1210,
-    CSSPropertyWebkitPaddingStart = 1211,
-    CSSPropertyWebkitPerspective = 1212,
-    CSSPropertyWebkitPerspectiveOrigin = 1213,
-    CSSPropertyWebkitPerspectiveOriginX = 1214,
-    CSSPropertyWebkitPerspectiveOriginY = 1215,
-    CSSPropertyWebkitRtlOrdering = 1216,
-    CSSPropertyWebkitTextDecorationsInEffect = 1217,
-    CSSPropertyWebkitTextFillColor = 1218,
-    CSSPropertyWebkitTextSecurity = 1219,
-    CSSPropertyWebkitTextSizeAdjust = 1220,
-    CSSPropertyWebkitTextStroke = 1221,
-    CSSPropertyWebkitTextStrokeColor = 1222,
-    CSSPropertyWebkitTextStrokeWidth = 1223,
-    CSSPropertyWebkitTransform = 1224,
-    CSSPropertyWebkitTransformOrigin = 1225,
-    CSSPropertyWebkitTransformOriginX = 1226,
-    CSSPropertyWebkitTransformOriginY = 1227,
-    CSSPropertyWebkitTransformOriginZ = 1228,
-    CSSPropertyWebkitTransformStyle = 1229,
-    CSSPropertyWebkitTransition = 1230,
-    CSSPropertyWebkitTransitionDelay = 1231,
-    CSSPropertyWebkitTransitionDuration = 1232,
-    CSSPropertyWebkitTransitionProperty = 1233,
-    CSSPropertyWebkitTransitionTimingFunction = 1234,
-    CSSPropertyWebkitUserDrag = 1235,
-    CSSPropertyWebkitUserModify = 1236,
-    CSSPropertyWebkitUserSelect = 1237,
-    CSSPropertyWebkitVariableDeclarationBlock = 1238,
-    CSSPropertyClipPath = 1239,
-    CSSPropertyClipRule = 1240,
-    CSSPropertyMask = 1241,
-    CSSPropertyEnableBackground = 1242,
-    CSSPropertyFilter = 1243,
-    CSSPropertyFloodColor = 1244,
-    CSSPropertyFloodOpacity = 1245,
-    CSSPropertyLightingColor = 1246,
-    CSSPropertyStopColor = 1247,
-    CSSPropertyStopOpacity = 1248,
-    CSSPropertyColorInterpolation = 1249,
-    CSSPropertyColorInterpolationFilters = 1250,
-    CSSPropertyColorProfile = 1251,
-    CSSPropertyColorRendering = 1252,
-    CSSPropertyFill = 1253,
-    CSSPropertyFillOpacity = 1254,
-    CSSPropertyFillRule = 1255,
-    CSSPropertyImageRendering = 1256,
-    CSSPropertyMarker = 1257,
-    CSSPropertyMarkerEnd = 1258,
-    CSSPropertyMarkerMid = 1259,
-    CSSPropertyMarkerStart = 1260,
-    CSSPropertyShapeRendering = 1261,
-    CSSPropertyStroke = 1262,
-    CSSPropertyStrokeDasharray = 1263,
-    CSSPropertyStrokeDashoffset = 1264,
-    CSSPropertyStrokeLinecap = 1265,
-    CSSPropertyStrokeLinejoin = 1266,
-    CSSPropertyStrokeMiterlimit = 1267,
-    CSSPropertyStrokeOpacity = 1268,
-    CSSPropertyStrokeWidth = 1269,
-    CSSPropertyTextRendering = 1270,
+    CSSPropertyWebkitBoxShadow = 1168,
+    CSSPropertyWebkitBoxSizing = 1169,
+    CSSPropertyWebkitColumnBreakAfter = 1170,
+    CSSPropertyWebkitColumnBreakBefore = 1171,
+    CSSPropertyWebkitColumnBreakInside = 1172,
+    CSSPropertyWebkitColumnCount = 1173,
+    CSSPropertyWebkitColumnGap = 1174,
+    CSSPropertyWebkitColumnRule = 1175,
+    CSSPropertyWebkitColumnRuleColor = 1176,
+    CSSPropertyWebkitColumnRuleStyle = 1177,
+    CSSPropertyWebkitColumnRuleWidth = 1178,
+    CSSPropertyWebkitColumnWidth = 1179,
+    CSSPropertyWebkitColumns = 1180,
+    CSSPropertyWebkitFontSizeDelta = 1181,
+    CSSPropertyWebkitFontSmoothing = 1182,
+    CSSPropertyWebkitHighlight = 1183,
+    CSSPropertyWebkitLineBreak = 1184,
+    CSSPropertyWebkitLineClamp = 1185,
+    CSSPropertyWebkitMarginBottomCollapse = 1186,
+    CSSPropertyWebkitMarginCollapse = 1187,
+    CSSPropertyWebkitMarginStart = 1188,
+    CSSPropertyWebkitMarginTopCollapse = 1189,
+    CSSPropertyWebkitMarquee = 1190,
+    CSSPropertyWebkitMarqueeDirection = 1191,
+    CSSPropertyWebkitMarqueeIncrement = 1192,
+    CSSPropertyWebkitMarqueeRepetition = 1193,
+    CSSPropertyWebkitMarqueeSpeed = 1194,
+    CSSPropertyWebkitMarqueeStyle = 1195,
+    CSSPropertyWebkitMask = 1196,
+    CSSPropertyWebkitMaskAttachment = 1197,
+    CSSPropertyWebkitMaskBoxImage = 1198,
+    CSSPropertyWebkitMaskClip = 1199,
+    CSSPropertyWebkitMaskComposite = 1200,
+    CSSPropertyWebkitMaskImage = 1201,
+    CSSPropertyWebkitMaskOrigin = 1202,
+    CSSPropertyWebkitMaskPosition = 1203,
+    CSSPropertyWebkitMaskPositionX = 1204,
+    CSSPropertyWebkitMaskPositionY = 1205,
+    CSSPropertyWebkitMaskRepeat = 1206,
+    CSSPropertyWebkitMaskRepeatX = 1207,
+    CSSPropertyWebkitMaskRepeatY = 1208,
+    CSSPropertyWebkitMaskSize = 1209,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1210,
+    CSSPropertyWebkitNbspMode = 1211,
+    CSSPropertyWebkitPaddingStart = 1212,
+    CSSPropertyWebkitPerspective = 1213,
+    CSSPropertyWebkitPerspectiveOrigin = 1214,
+    CSSPropertyWebkitPerspectiveOriginX = 1215,
+    CSSPropertyWebkitPerspectiveOriginY = 1216,
+    CSSPropertyWebkitRtlOrdering = 1217,
+    CSSPropertyWebkitTextDecorationsInEffect = 1218,
+    CSSPropertyWebkitTextFillColor = 1219,
+    CSSPropertyWebkitTextSecurity = 1220,
+    CSSPropertyWebkitTextSizeAdjust = 1221,
+    CSSPropertyWebkitTextStroke = 1222,
+    CSSPropertyWebkitTextStrokeColor = 1223,
+    CSSPropertyWebkitTextStrokeWidth = 1224,
+    CSSPropertyWebkitTransform = 1225,
+    CSSPropertyWebkitTransformOrigin = 1226,
+    CSSPropertyWebkitTransformOriginX = 1227,
+    CSSPropertyWebkitTransformOriginY = 1228,
+    CSSPropertyWebkitTransformOriginZ = 1229,
+    CSSPropertyWebkitTransformStyle = 1230,
+    CSSPropertyWebkitTransition = 1231,
+    CSSPropertyWebkitTransitionDelay = 1232,
+    CSSPropertyWebkitTransitionDuration = 1233,
+    CSSPropertyWebkitTransitionProperty = 1234,
+    CSSPropertyWebkitTransitionTimingFunction = 1235,
+    CSSPropertyWebkitUserDrag = 1236,
+    CSSPropertyWebkitUserModify = 1237,
+    CSSPropertyWebkitUserSelect = 1238,
+    CSSPropertyWebkitVariableDeclarationBlock = 1239,
+    CSSPropertyClipPath = 1240,
+    CSSPropertyClipRule = 1241,
+    CSSPropertyMask = 1242,
+    CSSPropertyEnableBackground = 1243,
+    CSSPropertyFilter = 1244,
+    CSSPropertyFloodColor = 1245,
+    CSSPropertyFloodOpacity = 1246,
+    CSSPropertyLightingColor = 1247,
+    CSSPropertyStopColor = 1248,
+    CSSPropertyStopOpacity = 1249,
+    CSSPropertyColorInterpolation = 1250,
+    CSSPropertyColorInterpolationFilters = 1251,
+    CSSPropertyColorProfile = 1252,
+    CSSPropertyColorRendering = 1253,
+    CSSPropertyFill = 1254,
+    CSSPropertyFillOpacity = 1255,
+    CSSPropertyFillRule = 1256,
+    CSSPropertyImageRendering = 1257,
+    CSSPropertyMarker = 1258,
+    CSSPropertyMarkerEnd = 1259,
+    CSSPropertyMarkerMid = 1260,
+    CSSPropertyMarkerStart = 1261,
+    CSSPropertyShapeRendering = 1262,
+    CSSPropertyStroke = 1263,
+    CSSPropertyStrokeDasharray = 1264,
+    CSSPropertyStrokeDashoffset = 1265,
+    CSSPropertyStrokeLinecap = 1266,
+    CSSPropertyStrokeLinejoin = 1267,
+    CSSPropertyStrokeMiterlimit = 1268,
+    CSSPropertyStrokeOpacity = 1269,
+    CSSPropertyStrokeWidth = 1270,
     CSSPropertyAlignmentBaseline = 1271,
     CSSPropertyBaselineShift = 1272,
     CSSPropertyDominantBaseline = 1273,
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index 1975392..c2143c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -191,7 +191,7 @@ findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 548,
+      TOTAL_KEYWORDS = 549,
       MIN_WORD_LENGTH = 2,
       MAX_WORD_LENGTH = 31,
       MIN_HASH_VALUE = 0,
@@ -206,7 +206,7 @@ findValue (register const char *str, register unsigned int len)
       {"300", CSSValue300},
 #line 289 "CSSValueKeywords.gperf"
       {"end", CSSValueEnd},
-#line 556 "CSSValueKeywords.gperf"
+#line 557 "CSSValueKeywords.gperf"
       {"lr", CSSValueLr},
 #line 48 "CSSValueKeywords.gperf"
       {"900", CSSValue900},
@@ -226,7 +226,7 @@ findValue (register const char *str, register unsigned int len)
       {"400", CSSValue400},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 490 "CSSValueKeywords.gperf"
+#line 494 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
@@ -234,13 +234,13 @@ findValue (register const char *str, register unsigned int len)
       {"above", CSSValueAbove},
 #line 253 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 411 "CSSValueKeywords.gperf"
+#line 415 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
 #line 13 "CSSValueKeywords.gperf"
       {"none", CSSValueNone},
-#line 502 "CSSValueKeywords.gperf"
+#line 506 "CSSValueKeywords.gperf"
       {"plum", CSSValuePlum},
-#line 558 "CSSValueKeywords.gperf"
+#line 559 "CSSValueKeywords.gperf"
       {"tb", CSSValueTb},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
@@ -258,7 +258,7 @@ findValue (register const char *str, register unsigned int len)
       {"monospace", CSSValueMonospace},
 #line 216 "CSSValueKeywords.gperf"
       {"e-resize", CSSValueEResize},
-#line 378 "CSSValueKeywords.gperf"
+#line 379 "CSSValueKeywords.gperf"
       {"lines", CSSValueLines},
 #line 222 "CSSValueKeywords.gperf"
       {"s-resize", CSSValueSResize},
@@ -272,7 +272,7 @@ findValue (register const char *str, register unsigned int len)
       {"lime", CSSValueLime},
 #line 164 "CSSValueKeywords.gperf"
       {"circle", CSSValueCircle},
-#line 474 "CSSValueKeywords.gperf"
+#line 478 "CSSValueKeywords.gperf"
       {"linen", CSSValueLinen},
 #line 219 "CSSValueKeywords.gperf"
       {"n-resize", CSSValueNResize},
@@ -280,15 +280,15 @@ findValue (register const char *str, register unsigned int len)
       {"inset", CSSValueInset},
 #line 296 "CSSValueKeywords.gperf"
       {"multiple", CSSValueMultiple},
-#line 410 "CSSValueKeywords.gperf"
+#line 414 "CSSValueKeywords.gperf"
       {"chocolate", CSSValueChocolate},
 #line 314 "CSSValueKeywords.gperf"
       {"clip", CSSValueClip},
-#line 374 "CSSValueKeywords.gperf"
+#line 375 "CSSValueKeywords.gperf"
       {"contain", CSSValueContain},
-#line 414 "CSSValueKeywords.gperf"
+#line 418 "CSSValueKeywords.gperf"
       {"crimson", CSSValueCrimson},
-#line 413 "CSSValueKeywords.gperf"
+#line 417 "CSSValueKeywords.gperf"
       {"cornsilk", CSSValueCornsilk},
 #line 187 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
@@ -296,21 +296,21 @@ findValue (register const char *str, register unsigned int len)
       {"scroll", CSSValueScroll},
 #line 254 "CSSValueKeywords.gperf"
       {"embed", CSSValueEmbed},
-#line 521 "CSSValueKeywords.gperf"
+#line 525 "CSSValueKeywords.gperf"
       {"tomato", CSSValueTomato},
 #line 150 "CSSValueKeywords.gperf"
       {"top", CSSValueTop},
 #line 264 "CSSValueKeywords.gperf"
       {"loud", CSSValueLoud},
-#line 370 "CSSValueKeywords.gperf"
+#line 371 "CSSValueKeywords.gperf"
       {"content", CSSValueContent},
 #line 77 "CSSValueKeywords.gperf"
       {"blue", CSSValueBlue},
 #line 263 "CSSValueKeywords.gperf"
       {"local", CSSValueLocal},
-#line 523 "CSSValueKeywords.gperf"
+#line 527 "CSSValueKeywords.gperf"
       {"violet", CSSValueViolet},
-#line 501 "CSSValueKeywords.gperf"
+#line 505 "CSSValueKeywords.gperf"
       {"pink", CSSValuePink},
 #line 284 "CSSValueKeywords.gperf"
       {"thin", CSSValueThin},
@@ -324,23 +324,23 @@ findValue (register const char *str, register unsigned int len)
       {"initial", CSSValueInitial},
 #line 82 "CSSValueKeywords.gperf"
       {"maroon", CSSValueMaroon},
-#line 383 "CSSValueKeywords.gperf"
+#line 384 "CSSValueKeywords.gperf"
       {"ease", CSSValueEase},
-#line 507 "CSSValueKeywords.gperf"
+#line 511 "CSSValueKeywords.gperf"
       {"salmon", CSSValueSalmon},
-#line 519 "CSSValueKeywords.gperf"
+#line 523 "CSSValueKeywords.gperf"
       {"tan", CSSValueTan},
-#line 358 "CSSValueKeywords.gperf"
+#line 359 "CSSValueKeywords.gperf"
       {"caret", CSSValueCaret},
-#line 520 "CSSValueKeywords.gperf"
+#line 524 "CSSValueKeywords.gperf"
       {"thistle", CSSValueThistle},
 #line 189 "CSSValueKeywords.gperf"
       {"table", CSSValueTable},
 #line 283 "CSSValueKeywords.gperf"
       {"thick", CSSValueThick},
-#line 488 "CSSValueKeywords.gperf"
+#line 492 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 553 "CSSValueKeywords.gperf"
+#line 554 "CSSValueKeywords.gperf"
       {"lr-tb", CSSValueLrTb},
 #line 162 "CSSValueKeywords.gperf"
       {"inside", CSSValueInside},
@@ -348,23 +348,23 @@ findValue (register const char *str, register unsigned int len)
       {"slide", CSSValueSlide},
 #line 145 "CSSValueKeywords.gperf"
       {"middle", CSSValueMiddle},
-#line 401 "CSSValueKeywords.gperf"
+#line 405 "CSSValueKeywords.gperf"
       {"azure", CSSValueAzure},
 #line 75 "CSSValueKeywords.gperf"
       {"aqua", CSSValueAqua},
-#line 415 "CSSValueKeywords.gperf"
+#line 419 "CSSValueKeywords.gperf"
       {"cyan", CSSValueCyan},
-#line 557 "CSSValueKeywords.gperf"
+#line 558 "CSSValueKeywords.gperf"
       {"rl", CSSValueRl},
 #line 324 "CSSValueKeywords.gperf"
       {"space", CSSValueSpace},
-#line 405 "CSSValueKeywords.gperf"
+#line 409 "CSSValueKeywords.gperf"
       {"blueviolet", CSSValueBlueviolet},
 #line 184 "CSSValueKeywords.gperf"
       {"block", CSSValueBlock},
 #line 163 "CSSValueKeywords.gperf"
       {"disc", CSSValueDisc},
-#line 334 "CSSValueKeywords.gperf"
+#line 335 "CSSValueKeywords.gperf"
       {"listitem", CSSValueListitem},
 #line 16 "CSSValueKeywords.gperf"
       {"groove", CSSValueGroove},
@@ -372,13 +372,13 @@ findValue (register const char *str, register unsigned int len)
       {"ltr", CSSValueLtr},
 #line 202 "CSSValueKeywords.gperf"
       {"auto", CSSValueAuto},
-#line 453 "CSSValueKeywords.gperf"
+#line 457 "CSSValueKeywords.gperf"
       {"khaki", CSSValueKhaki},
-#line 451 "CSSValueKeywords.gperf"
+#line 455 "CSSValueKeywords.gperf"
       {"indigo", CSSValueIndigo},
-#line 555 "CSSValueKeywords.gperf"
+#line 556 "CSSValueKeywords.gperf"
       {"tb-rl", CSSValueTbRl},
-#line 380 "CSSValueKeywords.gperf"
+#line 381 "CSSValueKeywords.gperf"
       {"paused", CSSValuePaused},
 #line 22 "CSSValueKeywords.gperf"
       {"double", CSSValueDouble},
@@ -390,7 +390,7 @@ findValue (register const char *str, register unsigned int len)
       {"visible", CSSValueVisible},
 #line 37 "CSSValueKeywords.gperf"
       {"bold", CSSValueBold},
-#line 516 "CSSValueKeywords.gperf"
+#line 520 "CSSValueKeywords.gperf"
       {"snow", CSSValueSnow},
 #line 249 "CSSValueKeywords.gperf"
       {"blink", CSSValueBlink},
@@ -398,7 +398,7 @@ findValue (register const char *str, register unsigned int len)
       {"move", CSSValueMove},
 #line 302 "CSSValueKeywords.gperf"
       {"slow", CSSValueSlow},
-#line 384 "CSSValueKeywords.gperf"
+#line 385 "CSSValueKeywords.gperf"
       {"linear", CSSValueLinear},
 #line 88 "CSSValueKeywords.gperf"
       {"silver", CSSValueSilver},
@@ -410,9 +410,9 @@ findValue (register const char *str, register unsigned int len)
       {"caption", CSSValueCaption},
 #line 18 "CSSValueKeywords.gperf"
       {"outset", CSSValueOutset},
-#line 395 "CSSValueKeywords.gperf"
+#line 396 "CSSValueKeywords.gperf"
       {"stroke", CSSValueStroke},
-#line 527 "CSSValueKeywords.gperf"
+#line 531 "CSSValueKeywords.gperf"
       {"nonzero", CSSValueNonzero},
 #line 295 "CSSValueKeywords.gperf"
       {"single", CSSValueSingle},
@@ -426,7 +426,7 @@ findValue (register const char *str, register unsigned int len)
       {"black", CSSValueBlack},
 #line 223 "CSSValueKeywords.gperf"
       {"w-resize", CSSValueWResize},
-#line 428 "CSSValueKeywords.gperf"
+#line 432 "CSSValueKeywords.gperf"
       {"darksalmon", CSSValueDarksalmon},
 #line 304 "CSSValueKeywords.gperf"
       {"infinite", CSSValueInfinite},
@@ -436,13 +436,13 @@ findValue (register const char *str, register unsigned int len)
       {"inactivecaption", CSSValueInactivecaption},
 #line 144 "CSSValueKeywords.gperf"
       {"baseline", CSSValueBaseline},
-#line 367 "CSSValueKeywords.gperf"
+#line 368 "CSSValueKeywords.gperf"
       {"round", CSSValueRound},
 #line 238 "CSSValueKeywords.gperf"
       {"capitalize", CSSValueCapitalize},
 #line 244 "CSSValueKeywords.gperf"
       {"absolute", CSSValueAbsolute},
-#line 486 "CSSValueKeywords.gperf"
+#line 490 "CSSValueKeywords.gperf"
       {"mintcream", CSSValueMintcream},
 #line 33 "CSSValueKeywords.gperf"
       {"oblique", CSSValueOblique},
@@ -452,15 +452,15 @@ findValue (register const char *str, register unsigned int len)
       {"large", CSSValueLarge},
 #line 274 "CSSValueKeywords.gperf"
       {"portrait", CSSValuePortrait},
-#line 445 "CSSValueKeywords.gperf"
+#line 449 "CSSValueKeywords.gperf"
       {"gold", CSSValueGold},
 #line 57 "CSSValueKeywords.gperf"
       {"smaller", CSSValueSmaller},
-#line 434 "CSSValueKeywords.gperf"
+#line 438 "CSSValueKeywords.gperf"
       {"darkviolet", CSSValueDarkviolet},
-#line 377 "CSSValueKeywords.gperf"
+#line 378 "CSSValueKeywords.gperf"
       {"visual", CSSValueVisual},
-#line 450 "CSSValueKeywords.gperf"
+#line 454 "CSSValueKeywords.gperf"
       {"indianred", CSSValueIndianred},
 #line 85 "CSSValueKeywords.gperf"
       {"orange", CSSValueOrange},
@@ -470,13 +470,13 @@ findValue (register const char *str, register unsigned int len)
       {"pointer", CSSValuePointer},
 #line 90 "CSSValueKeywords.gperf"
       {"white", CSSValueWhite},
-#line 522 "CSSValueKeywords.gperf"
+#line 526 "CSSValueKeywords.gperf"
       {"turquoise", CSSValueTurquoise},
 #line 212 "CSSValueKeywords.gperf"
       {"no-drop", CSSValueNoDrop},
-#line 554 "CSSValueKeywords.gperf"
+#line 555 "CSSValueKeywords.gperf"
       {"rl-tb", CSSValueRlTb},
-#line 393 "CSSValueKeywords.gperf"
+#line 394 "CSSValueKeywords.gperf"
       {"painted", CSSValuePainted},
 #line 208 "CSSValueKeywords.gperf"
       {"cell", CSSValueCell},
@@ -486,27 +486,27 @@ findValue (register const char *str, register unsigned int len)
       {"pre", CSSValuePre},
 #line 165 "CSSValueKeywords.gperf"
       {"square", CSSValueSquare},
-#line 396 "CSSValueKeywords.gperf"
+#line 397 "CSSValueKeywords.gperf"
       {"antialiased", CSSValueAntialiased},
-#line 537 "CSSValueKeywords.gperf"
+#line 539 "CSSValueKeywords.gperf"
       {"butt", CSSValueButt},
-#line 406 "CSSValueKeywords.gperf"
+#line 410 "CSSValueKeywords.gperf"
       {"brown", CSSValueBrown},
 #line 32 "CSSValueKeywords.gperf"
       {"italic", CSSValueItalic},
-#line 535 "CSSValueKeywords.gperf"
+#line 538 "CSSValueKeywords.gperf"
       {"crispedges", CSSValueCrispedges},
-#line 512 "CSSValueKeywords.gperf"
+#line 516 "CSSValueKeywords.gperf"
       {"skyblue", CSSValueSkyblue},
 #line 330 "CSSValueKeywords.gperf"
       {"button", CSSValueButton},
-#line 525 "CSSValueKeywords.gperf"
+#line 529 "CSSValueKeywords.gperf"
       {"whitesmoke", CSSValueWhitesmoke},
 #line 282 "CSSValueKeywords.gperf"
       {"static", CSSValueStatic},
 #line 237 "CSSValueKeywords.gperf"
       {"rtl", CSSValueRtl},
-#line 400 "CSSValueKeywords.gperf"
+#line 404 "CSSValueKeywords.gperf"
       {"aquamarine", CSSValueAquamarine},
 #line 310 "CSSValueKeywords.gperf"
       {"element", CSSValueElement},
@@ -516,31 +516,31 @@ findValue (register const char *str, register unsigned int len)
       {"bottom", CSSValueBottom},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 394 "CSSValueKeywords.gperf"
+#line 395 "CSSValueKeywords.gperf"
       {"fill", CSSValueFill},
-#line 368 "CSSValueKeywords.gperf"
+#line 369 "CSSValueKeywords.gperf"
       {"border", CSSValueBorder},
 #line 35 "CSSValueKeywords.gperf"
       {"small-caps", CSSValueSmallCaps},
 #line 211 "CSSValueKeywords.gperf"
       {"progress", CSSValueProgress},
-#line 379 "CSSValueKeywords.gperf"
+#line 380 "CSSValueKeywords.gperf"
       {"running", CSSValueRunning},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 398 "CSSValueKeywords.gperf"
+#line 402 "CSSValueKeywords.gperf"
       {"aliceblue", CSSValueAliceblue},
 #line 197 "CSSValueKeywords.gperf"
       {"table-cell", CSSValueTableCell},
-#line 375 "CSSValueKeywords.gperf"
+#line 376 "CSSValueKeywords.gperf"
       {"cover", CSSValueCover},
-#line 385 "CSSValueKeywords.gperf"
+#line 386 "CSSValueKeywords.gperf"
       {"ease-in", CSSValueEaseIn},
 #line 92 "CSSValueKeywords.gperf"
       {"transparent", CSSValueTransparent},
-#line 511 "CSSValueKeywords.gperf"
+#line 515 "CSSValueKeywords.gperf"
       {"sienna", CSSValueSienna},
-#line 390 "CSSValueKeywords.gperf"
+#line 391 "CSSValueKeywords.gperf"
       {"visiblepainted", CSSValueVisiblepainted},
 #line 285 "CSSValueKeywords.gperf"
       {"underline", CSSValueUnderline},
@@ -558,13 +558,13 @@ findValue (register const char *str, register unsigned int len)
       {"ahead", CSSValueAhead},
 #line 185 "CSSValueKeywords.gperf"
       {"list-item", CSSValueListItem},
-#line 376 "CSSValueKeywords.gperf"
+#line 377 "CSSValueKeywords.gperf"
       {"logical", CSSValueLogical},
 #line 186 "CSSValueKeywords.gperf"
       {"run-in", CSSValueRunIn},
 #line 259 "CSSValueKeywords.gperf"
       {"invert", CSSValueInvert},
-#line 372 "CSSValueKeywords.gperf"
+#line 373 "CSSValueKeywords.gperf"
       {"padding", CSSValuePadding},
 #line 306 "CSSValueKeywords.gperf"
       {"alternate", CSSValueAlternate},
@@ -578,15 +578,15 @@ findValue (register const char *str, register unsigned int len)
       {"inline-table", CSSValueInlineTable},
 #line 19 "CSSValueKeywords.gperf"
       {"dotted", CSSValueDotted},
-#line 538 "CSSValueKeywords.gperf"
+#line 540 "CSSValueKeywords.gperf"
       {"miter", CSSValueMiter},
-#line 473 "CSSValueKeywords.gperf"
+#line 477 "CSSValueKeywords.gperf"
       {"limegreen", CSSValueLimegreen},
 #line 312 "CSSValueKeywords.gperf"
       {"intrinsic", CSSValueIntrinsic},
 #line 141 "CSSValueKeywords.gperf"
       {"xor", CSSValueXor},
-#line 491 "CSSValueKeywords.gperf"
+#line 495 "CSSValueKeywords.gperf"
       {"olivedrab", CSSValueOlivedrab},
 #line 188 "CSSValueKeywords.gperf"
       {"inline-block", CSSValueInlineBlock},
@@ -594,13 +594,13 @@ findValue (register const char *str, register unsigned int len)
       {"source-in", CSSValueSourceIn},
 #line 316 "CSSValueKeywords.gperf"
       {"discard", CSSValueDiscard},
-#line 497 "CSSValueKeywords.gperf"
+#line 501 "CSSValueKeywords.gperf"
       {"palevioletred", CSSValuePalevioletred},
 #line 27 "CSSValueKeywords.gperf"
       {"small-caption", CSSValueSmallCaption},
-#line 533 "CSSValueKeywords.gperf"
+#line 399 "CSSValueKeywords.gperf"
       {"optimizespeed", CSSValueOptimizespeed},
-#line 388 "CSSValueKeywords.gperf"
+#line 389 "CSSValueKeywords.gperf"
       {"document", CSSValueDocument},
 #line 89 "CSSValueKeywords.gperf"
       {"teal", CSSValueTeal},
@@ -608,15 +608,15 @@ findValue (register const char *str, register unsigned int len)
       {"larger", CSSValueLarger},
 #line 116 "CSSValueKeywords.gperf"
       {"threedface", CSSValueThreedface},
-#line 403 "CSSValueKeywords.gperf"
+#line 407 "CSSValueKeywords.gperf"
       {"bisque", CSSValueBisque},
-#line 381 "CSSValueKeywords.gperf"
+#line 382 "CSSValueKeywords.gperf"
       {"flat", CSSValueFlat},
-#line 408 "CSSValueKeywords.gperf"
+#line 412 "CSSValueKeywords.gperf"
       {"cadetblue", CSSValueCadetblue},
-#line 513 "CSSValueKeywords.gperf"
+#line 517 "CSSValueKeywords.gperf"
       {"slateblue", CSSValueSlateblue},
-#line 392 "CSSValueKeywords.gperf"
+#line 393 "CSSValueKeywords.gperf"
       {"visiblestroke", CSSValueVisiblestroke},
 #line 87 "CSSValueKeywords.gperf"
       {"red", CSSValueRed},
@@ -624,11 +624,11 @@ findValue (register const char *str, register unsigned int len)
       {"table-caption", CSSValueTableCaption},
 #line 136 "CSSValueKeywords.gperf"
       {"source-atop", CSSValueSourceAtop},
-#line 423 "CSSValueKeywords.gperf"
+#line 427 "CSSValueKeywords.gperf"
       {"darkmagenta", CSSValueDarkmagenta},
 #line 50 "CSSValueKeywords.gperf"
       {"x-small", CSSValueXSmall},
-#line 531 "CSSValueKeywords.gperf"
+#line 535 "CSSValueKeywords.gperf"
       {"srgb", CSSValueSrgb},
 #line 228 "CSSValueKeywords.gperf"
       {"col-resize", CSSValueColResize},
@@ -638,9 +638,9 @@ findValue (register const char *str, register unsigned int len)
       {"fast", CSSValueFast},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 427 "CSSValueKeywords.gperf"
+#line 431 "CSSValueKeywords.gperf"
       {"darkred", CSSValueDarkred},
-#line 495 "CSSValueKeywords.gperf"
+#line 499 "CSSValueKeywords.gperf"
       {"palegreen", CSSValuePalegreen},
 #line 320 "CSSValueKeywords.gperf"
       {"continuous", CSSValueContinuous},
@@ -662,15 +662,15 @@ findValue (register const char *str, register unsigned int len)
       {"menu", CSSValueMenu},
 #line 267 "CSSValueKeywords.gperf"
       {"mix", CSSValueMix},
-#line 543 "CSSValueKeywords.gperf"
+#line 544 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
 #line 154 "CSSValueKeywords.gperf"
       {"left", CSSValueLeft},
 #line 14 "CSSValueKeywords.gperf"
       {"hidden", CSSValueHidden},
-#line 500 "CSSValueKeywords.gperf"
+#line 504 "CSSValueKeywords.gperf"
       {"peru", CSSValuePeru},
-#line 475 "CSSValueKeywords.gperf"
+#line 479 "CSSValueKeywords.gperf"
       {"magenta", CSSValueMagenta},
 #line 278 "CSSValueKeywords.gperf"
       {"relative", CSSValueRelative},
@@ -682,11 +682,11 @@ findValue (register const char *str, register unsigned int len)
       {"medium", CSSValueMedium},
 #line 220 "CSSValueKeywords.gperf"
       {"se-resize", CSSValueSeResize},
-#line 389 "CSSValueKeywords.gperf"
+#line 390 "CSSValueKeywords.gperf"
       {"reset", CSSValueReset},
-#line 505 "CSSValueKeywords.gperf"
+#line 509 "CSSValueKeywords.gperf"
       {"royalblue", CSSValueRoyalblue},
-#line 416 "CSSValueKeywords.gperf"
+#line 420 "CSSValueKeywords.gperf"
       {"darkblue", CSSValueDarkblue},
 #line 217 "CSSValueKeywords.gperf"
       {"ne-resize", CSSValueNeResize},
@@ -696,17 +696,17 @@ findValue (register const char *str, register unsigned int len)
       {"appworkspace", CSSValueAppworkspace},
 #line 251 "CSSValueKeywords.gperf"
       {"close-quote", CSSValueCloseQuote},
-#line 391 "CSSValueKeywords.gperf"
+#line 392 "CSSValueKeywords.gperf"
       {"visiblefill", CSSValueVisiblefill},
-#line 492 "CSSValueKeywords.gperf"
+#line 496 "CSSValueKeywords.gperf"
       {"orangered", CSSValueOrangered},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 524 "CSSValueKeywords.gperf"
+#line 528 "CSSValueKeywords.gperf"
       {"wheat", CSSValueWheat},
-#line 493 "CSSValueKeywords.gperf"
+#line 497 "CSSValueKeywords.gperf"
       {"orchid", CSSValueOrchid},
-#line 446 "CSSValueKeywords.gperf"
+#line 450 "CSSValueKeywords.gperf"
       {"goldenrod", CSSValueGoldenrod},
 #line 127 "CSSValueKeywords.gperf"
       {"repeat", CSSValueRepeat},
@@ -718,33 +718,33 @@ findValue (register const char *str, register unsigned int len)
       {"no-close-quote", CSSValueNoCloseQuote},
 #line 313 "CSSValueKeywords.gperf"
       {"min-intrinsic", CSSValueMinIntrinsic},
-#line 350 "CSSValueKeywords.gperf"
+#line 351 "CSSValueKeywords.gperf"
       {"menulist", CSSValueMenulist},
 #line 203 "CSSValueKeywords.gperf"
       {"crosshair", CSSValueCrosshair},
-#line 454 "CSSValueKeywords.gperf"
+#line 458 "CSSValueKeywords.gperf"
       {"lavender", CSSValueLavender},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
 #line 276 "CSSValueKeywords.gperf"
       {"pre-line", CSSValuePreLine},
-#line 420 "CSSValueKeywords.gperf"
+#line 424 "CSSValueKeywords.gperf"
       {"darkgreen", CSSValueDarkgreen},
-#line 430 "CSSValueKeywords.gperf"
+#line 434 "CSSValueKeywords.gperf"
       {"darkslateblue", CSSValueDarkslateblue},
 #line 269 "CSSValueKeywords.gperf"
       {"no-open-quote", CSSValueNoOpenQuote},
-#line 429 "CSSValueKeywords.gperf"
+#line 433 "CSSValueKeywords.gperf"
       {"darkseagreen", CSSValueDarkseagreen},
-#line 425 "CSSValueKeywords.gperf"
+#line 429 "CSSValueKeywords.gperf"
       {"darkorange", CSSValueDarkorange},
-#line 547 "CSSValueKeywords.gperf"
+#line 548 "CSSValueKeywords.gperf"
       {"alphabetic", CSSValueAlphabetic},
 #line 265 "CSSValueKeywords.gperf"
       {"lower", CSSValueLower},
-#line 386 "CSSValueKeywords.gperf"
+#line 387 "CSSValueKeywords.gperf"
       {"ease-out", CSSValueEaseOut},
-#line 551 "CSSValueKeywords.gperf"
+#line 552 "CSSValueKeywords.gperf"
       {"no-change", CSSValueNoChange},
 #line 287 "CSSValueKeywords.gperf"
       {"stretch", CSSValueStretch},
@@ -752,15 +752,15 @@ findValue (register const char *str, register unsigned int len)
       {"table-column", CSSValueTableColumn},
 #line 240 "CSSValueKeywords.gperf"
       {"lowercase", CSSValueLowercase},
-#line 424 "CSSValueKeywords.gperf"
+#line 428 "CSSValueKeywords.gperf"
       {"darkolivegreen", CSSValueDarkolivegreen},
-#line 517 "CSSValueKeywords.gperf"
+#line 521 "CSSValueKeywords.gperf"
       {"springgreen", CSSValueSpringgreen},
-#line 539 "CSSValueKeywords.gperf"
+#line 541 "CSSValueKeywords.gperf"
       {"bevel", CSSValueBevel},
 #line 179 "CSSValueKeywords.gperf"
       {"hiragana", CSSValueHiragana},
-#line 529 "CSSValueKeywords.gperf"
+#line 533 "CSSValueKeywords.gperf"
       {"accumulate", CSSValueAccumulate},
 #line 247 "CSSValueKeywords.gperf"
       {"below", CSSValueBelow},
@@ -768,7 +768,7 @@ findValue (register const char *str, register unsigned int len)
       {"nowrap", CSSValueNowrap},
 #line 69 "CSSValueKeywords.gperf"
       {"serif", CSSValueSerif},
-#line 443 "CSSValueKeywords.gperf"
+#line 447 "CSSValueKeywords.gperf"
       {"gainsboro", CSSValueGainsboro},
 #line 224 "CSSValueKeywords.gperf"
       {"ew-resize", CSSValueEwResize},
@@ -776,21 +776,21 @@ findValue (register const char *str, register unsigned int len)
       {"sw-resize", CSSValueSwResize},
 #line 135 "CSSValueKeywords.gperf"
       {"source-out", CSSValueSourceOut},
-#line 402 "CSSValueKeywords.gperf"
+#line 406 "CSSValueKeywords.gperf"
       {"beige", CSSValueBeige},
 #line 60 "CSSValueKeywords.gperf"
       {"narrower", CSSValueNarrower},
 #line 218 "CSSValueKeywords.gperf"
       {"nw-resize", CSSValueNwResize},
-#line 333 "CSSValueKeywords.gperf"
+#line 334 "CSSValueKeywords.gperf"
       {"listbox", CSSValueListbox},
-#line 449 "CSSValueKeywords.gperf"
+#line 453 "CSSValueKeywords.gperf"
       {"hotpink", CSSValueHotpink},
 #line 99 "CSSValueKeywords.gperf"
       {"buttonface", CSSValueButtonface},
-#line 494 "CSSValueKeywords.gperf"
+#line 498 "CSSValueKeywords.gperf"
       {"palegoldenrod", CSSValuePalegoldenrod},
-#line 532 "CSSValueKeywords.gperf"
+#line 536 "CSSValueKeywords.gperf"
       {"linearrgb", CSSValueLinearrgb},
 #line 20 "CSSValueKeywords.gperf"
       {"dashed", CSSValueDashed},
@@ -802,57 +802,59 @@ findValue (register const char *str, register unsigned int len)
       {"break-all", CSSValueBreakAll},
 #line 250 "CSSValueKeywords.gperf"
       {"both", CSSValueBoth},
-#line 409 "CSSValueKeywords.gperf"
+#line 413 "CSSValueKeywords.gperf"
       {"chartreuse", CSSValueChartreuse},
-#line 506 "CSSValueKeywords.gperf"
+#line 510 "CSSValueKeywords.gperf"
       {"saddlebrown", CSSValueSaddlebrown},
 #line 331 "CSSValueKeywords.gperf"
       {"button-bevel", CSSValueButtonBevel},
-#line 422 "CSSValueKeywords.gperf"
+#line 426 "CSSValueKeywords.gperf"
       {"darkkhaki", CSSValueDarkkhaki},
 #line 66 "CSSValueKeywords.gperf"
       {"expanded", CSSValueExpanded},
 #line 232 "CSSValueKeywords.gperf"
       {"help", CSSValueHelp},
-#line 440 "CSSValueKeywords.gperf"
+#line 444 "CSSValueKeywords.gperf"
       {"firebrick", CSSValueFirebrick},
-#line 528 "CSSValueKeywords.gperf"
+#line 532 "CSSValueKeywords.gperf"
       {"evenodd", CSSValueEvenodd},
 #line 142 "CSSValueKeywords.gperf"
       {"plus-darker", CSSValuePlusDarker},
 #line 273 "CSSValueKeywords.gperf"
       {"overline", CSSValueOverline},
-#line 417 "CSSValueKeywords.gperf"
+#line 421 "CSSValueKeywords.gperf"
       {"darkcyan", CSSValueDarkcyan},
 #line 293 "CSSValueKeywords.gperf"
       {"inline-axis", CSSValueInlineAxis},
 #line 107 "CSSValueKeywords.gperf"
       {"inactiveborder", CSSValueInactiveborder},
-#line 442 "CSSValueKeywords.gperf"
+#line 446 "CSSValueKeywords.gperf"
       {"forestgreen", CSSValueForestgreen},
 #line 103 "CSSValueKeywords.gperf"
       {"captiontext", CSSValueCaptiontext},
-#line 530 "CSSValueKeywords.gperf"
+#line 534 "CSSValueKeywords.gperf"
       {"new", CSSValueNew},
 #line 79 "CSSValueKeywords.gperf"
       {"gray", CSSValueGray},
 #line 194 "CSSValueKeywords.gperf"
       {"table-row", CSSValueTableRow},
-#line 549 "CSSValueKeywords.gperf"
+#line 333 "CSSValueKeywords.gperf"
+      {"list-button", CSSValueListButton},
+#line 550 "CSSValueKeywords.gperf"
       {"mathematical", CSSValueMathematical},
 #line 213 "CSSValueKeywords.gperf"
       {"not-allowed", CSSValueNotAllowed},
-#line 439 "CSSValueKeywords.gperf"
+#line 443 "CSSValueKeywords.gperf"
       {"dodgerblue", CSSValueDodgerblue},
-#line 487 "CSSValueKeywords.gperf"
+#line 491 "CSSValueKeywords.gperf"
       {"mistyrose", CSSValueMistyrose},
 #line 174 "CSSValueKeywords.gperf"
       {"upper-latin", CSSValueUpperLatin},
 #line 109 "CSSValueKeywords.gperf"
       {"inactivecaptiontext", CSSValueInactivecaptiontext},
-#line 509 "CSSValueKeywords.gperf"
+#line 513 "CSSValueKeywords.gperf"
       {"seagreen", CSSValueSeagreen},
-#line 355 "CSSValueKeywords.gperf"
+#line 356 "CSSValueKeywords.gperf"
       {"slider-vertical", CSSValueSliderVertical},
 #line 54 "CSSValueKeywords.gperf"
       {"x-large", CSSValueXLarge},
@@ -862,35 +864,35 @@ findValue (register const char *str, register unsigned int len)
       {"semi-condensed", CSSValueSemiCondensed},
 #line 78 "CSSValueKeywords.gperf"
       {"fuchsia", CSSValueFuchsia},
-#line 418 "CSSValueKeywords.gperf"
+#line 422 "CSSValueKeywords.gperf"
       {"darkgoldenrod", CSSValueDarkgoldenrod},
 #line 297 "CSSValueKeywords.gperf"
       {"forwards", CSSValueForwards},
-#line 510 "CSSValueKeywords.gperf"
+#line 514 "CSSValueKeywords.gperf"
       {"seashell", CSSValueSeashell},
 #line 298 "CSSValueKeywords.gperf"
       {"backwards", CSSValueBackwards},
 #line 119 "CSSValueKeywords.gperf"
       {"threedshadow", CSSValueThreedshadow},
-#line 382 "CSSValueKeywords.gperf"
+#line 383 "CSSValueKeywords.gperf"
       {"preserve-3d", CSSValuePreserve3d},
-#line 435 "CSSValueKeywords.gperf"
+#line 439 "CSSValueKeywords.gperf"
       {"deeppink", CSSValueDeeppink},
-#line 496 "CSSValueKeywords.gperf"
+#line 500 "CSSValueKeywords.gperf"
       {"paleturquoise", CSSValuePaleturquoise},
 #line 204 "CSSValueKeywords.gperf"
       {"default", CSSValueDefault},
 #line 138 "CSSValueKeywords.gperf"
       {"destination-in", CSSValueDestinationIn},
-#line 404 "CSSValueKeywords.gperf"
+#line 408 "CSSValueKeywords.gperf"
       {"blanchedalmond", CSSValueBlanchedalmond},
-#line 552 "CSSValueKeywords.gperf"
+#line 553 "CSSValueKeywords.gperf"
       {"reset-size", CSSValueResetSize},
-#line 518 "CSSValueKeywords.gperf"
+#line 522 "CSSValueKeywords.gperf"
       {"steelblue", CSSValueSteelblue},
 #line 70 "CSSValueKeywords.gperf"
       {"sans-serif", CSSValueSansSerif},
-#line 342 "CSSValueKeywords.gperf"
+#line 343 "CSSValueKeywords.gperf"
       {"media-slider", CSSValueMediaSlider},
 #line 230 "CSSValueKeywords.gperf"
       {"text", CSSValueText},
@@ -906,29 +908,29 @@ findValue (register const char *str, register unsigned int len)
       {"buttontext", CSSValueButtontext},
 #line 140 "CSSValueKeywords.gperf"
       {"destination-atop", CSSValueDestinationAtop},
-#line 477 "CSSValueKeywords.gperf"
+#line 481 "CSSValueKeywords.gperf"
       {"mediumblue", CSSValueMediumblue},
-#line 484 "CSSValueKeywords.gperf"
+#line 488 "CSSValueKeywords.gperf"
       {"mediumvioletred", CSSValueMediumvioletred},
-#line 452 "CSSValueKeywords.gperf"
+#line 456 "CSSValueKeywords.gperf"
       {"ivory", CSSValueIvory},
-#line 387 "CSSValueKeywords.gperf"
+#line 388 "CSSValueKeywords.gperf"
       {"ease-in-out", CSSValueEaseInOut},
-#line 548 "CSSValueKeywords.gperf"
+#line 549 "CSSValueKeywords.gperf"
       {"hanging", CSSValueHanging},
-#line 371 "CSSValueKeywords.gperf"
+#line 372 "CSSValueKeywords.gperf"
       {"content-box", CSSValueContentBox},
-#line 466 "CSSValueKeywords.gperf"
+#line 470 "CSSValueKeywords.gperf"
       {"lightsalmon", CSSValueLightsalmon},
-#line 397 "CSSValueKeywords.gperf"
+#line 398 "CSSValueKeywords.gperf"
       {"subpixel-antialiased", CSSValueSubpixelAntialiased},
-#line 407 "CSSValueKeywords.gperf"
+#line 411 "CSSValueKeywords.gperf"
       {"burlywood", CSSValueBurlywood},
-#line 444 "CSSValueKeywords.gperf"
+#line 448 "CSSValueKeywords.gperf"
       {"ghostwhite", CSSValueGhostwhite},
 #line 177 "CSSValueKeywords.gperf"
       {"georgian", CSSValueGeorgian},
-#line 426 "CSSValueKeywords.gperf"
+#line 430 "CSSValueKeywords.gperf"
       {"darkorchid", CSSValueDarkorchid},
 #line 245 "CSSValueKeywords.gperf"
       {"always", CSSValueAlways},
@@ -936,15 +938,15 @@ findValue (register const char *str, register unsigned int len)
       {"upper-roman", CSSValueUpperRoman},
 #line 172 "CSSValueKeywords.gperf"
       {"lower-latin", CSSValueLowerLatin},
-#line 456 "CSSValueKeywords.gperf"
+#line 460 "CSSValueKeywords.gperf"
       {"lawngreen", CSSValueLawngreen},
 #line 49 "CSSValueKeywords.gperf"
       {"xx-small", CSSValueXxSmall},
-#line 481 "CSSValueKeywords.gperf"
+#line 485 "CSSValueKeywords.gperf"
       {"mediumslateblue", CSSValueMediumslateblue},
 #line 271 "CSSValueKeywords.gperf"
       {"open-quote", CSSValueOpenQuote},
-#line 480 "CSSValueKeywords.gperf"
+#line 484 "CSSValueKeywords.gperf"
       {"mediumseagreen", CSSValueMediumseagreen},
 #line 326 "CSSValueKeywords.gperf"
       {"checkbox", CSSValueCheckbox},
@@ -956,37 +958,37 @@ findValue (register const char *str, register unsigned int len)
       {"fixed", CSSValueFixed},
 #line 72 "CSSValueKeywords.gperf"
       {"fantasy", CSSValueFantasy},
-#line 433 "CSSValueKeywords.gperf"
+#line 437 "CSSValueKeywords.gperf"
       {"darkturquoise", CSSValueDarkturquoise},
-#line 465 "CSSValueKeywords.gperf"
+#line 469 "CSSValueKeywords.gperf"
       {"lightpink", CSSValueLightpink},
 #line 277 "CSSValueKeywords.gperf"
       {"pre-wrap", CSSValuePreWrap},
 #line 125 "CSSValueKeywords.gperf"
       {"grey", CSSValueGrey},
-#line 479 "CSSValueKeywords.gperf"
+#line 483 "CSSValueKeywords.gperf"
       {"mediumpurple", CSSValueMediumpurple},
-#line 515 "CSSValueKeywords.gperf"
+#line 519 "CSSValueKeywords.gperf"
       {"slategrey", CSSValueSlategrey},
 #line 329 "CSSValueKeywords.gperf"
       {"square-button", CSSValueSquareButton},
-#line 514 "CSSValueKeywords.gperf"
+#line 518 "CSSValueKeywords.gperf"
       {"slategray", CSSValueSlategray},
-#line 438 "CSSValueKeywords.gperf"
+#line 442 "CSSValueKeywords.gperf"
       {"dimgrey", CSSValueDimgrey},
 #line 137 "CSSValueKeywords.gperf"
       {"destination-over", CSSValueDestinationOver},
-#line 437 "CSSValueKeywords.gperf"
+#line 441 "CSSValueKeywords.gperf"
       {"dimgray", CSSValueDimgray},
 #line 209 "CSSValueKeywords.gperf"
       {"context-menu", CSSValueContextMenu},
-#line 536 "CSSValueKeywords.gperf"
+#line 401 "CSSValueKeywords.gperf"
       {"geometricprecision", CSSValueGeometricprecision},
 #line 91 "CSSValueKeywords.gperf"
       {"yellow", CSSValueYellow},
 #line 317 "CSSValueKeywords.gperf"
       {"dot-dash", CSSValueDotDash},
-#line 485 "CSSValueKeywords.gperf"
+#line 489 "CSSValueKeywords.gperf"
       {"midnightblue", CSSValueMidnightblue},
 #line 155 "CSSValueKeywords.gperf"
       {"right", CSSValueRight},
@@ -994,43 +996,43 @@ findValue (register const char *str, register unsigned int len)
       {"background", CSSValueBackground},
 #line 39 "CSSValueKeywords.gperf"
       {"lighter", CSSValueLighter},
-#line 365 "CSSValueKeywords.gperf"
+#line 366 "CSSValueKeywords.gperf"
       {"textarea", CSSValueTextarea},
 #line 226 "CSSValueKeywords.gperf"
       {"nesw-resize", CSSValueNeswResize},
-#line 476 "CSSValueKeywords.gperf"
+#line 480 "CSSValueKeywords.gperf"
       {"mediumaquamarine", CSSValueMediumaquamarine},
 #line 110 "CSSValueKeywords.gperf"
       {"infobackground", CSSValueInfobackground},
 #line 113 "CSSValueKeywords.gperf"
       {"menutext", CSSValueMenutext},
-#line 550 "CSSValueKeywords.gperf"
+#line 551 "CSSValueKeywords.gperf"
       {"use-script", CSSValueUseScript},
-#line 489 "CSSValueKeywords.gperf"
+#line 493 "CSSValueKeywords.gperf"
       {"navajowhite", CSSValueNavajowhite},
 #line 61 "CSSValueKeywords.gperf"
       {"ultra-condensed", CSSValueUltraCondensed},
-#line 459 "CSSValueKeywords.gperf"
+#line 463 "CSSValueKeywords.gperf"
       {"lightcoral", CSSValueLightcoral},
 #line 143 "CSSValueKeywords.gperf"
       {"plus-lighter", CSSValuePlusLighter},
-#line 366 "CSSValueKeywords.gperf"
+#line 367 "CSSValueKeywords.gperf"
       {"caps-lock-indicator", CSSValueCapsLockIndicator},
 #line 168 "CSSValueKeywords.gperf"
       {"lower-roman", CSSValueLowerRoman},
-#line 503 "CSSValueKeywords.gperf"
+#line 507 "CSSValueKeywords.gperf"
       {"powderblue", CSSValuePowderblue},
 #line 101 "CSSValueKeywords.gperf"
       {"buttonshadow", CSSValueButtonshadow},
 #line 139 "CSSValueKeywords.gperf"
       {"destination-out", CSSValueDestinationOut},
-#line 542 "CSSValueKeywords.gperf"
+#line 543 "CSSValueKeywords.gperf"
       {"after-edge", CSSValueAfterEdge},
-#line 421 "CSSValueKeywords.gperf"
+#line 425 "CSSValueKeywords.gperf"
       {"darkgrey", CSSValueDarkgrey},
-#line 419 "CSSValueKeywords.gperf"
+#line 423 "CSSValueKeywords.gperf"
       {"darkgray", CSSValueDarkgray},
-#line 412 "CSSValueKeywords.gperf"
+#line 416 "CSSValueKeywords.gperf"
       {"cornflowerblue", CSSValueCornflowerblue},
 #line 328 "CSSValueKeywords.gperf"
       {"push-button", CSSValuePushButton},
@@ -1044,71 +1046,71 @@ findValue (register const char *str, register unsigned int len)
       {"hebrew", CSSValueHebrew},
 #line 122 "CSSValueKeywords.gperf"
       {"windowtext", CSSValueWindowtext},
-#line 432 "CSSValueKeywords.gperf"
+#line 436 "CSSValueKeywords.gperf"
       {"darkslategrey", CSSValueDarkslategrey},
-#line 431 "CSSValueKeywords.gperf"
+#line 435 "CSSValueKeywords.gperf"
       {"darkslategray", CSSValueDarkslategray},
-#line 546 "CSSValueKeywords.gperf"
+#line 547 "CSSValueKeywords.gperf"
       {"ideographic", CSSValueIdeographic},
 #line 207 "CSSValueKeywords.gperf"
       {"vertical-text", CSSValueVerticalText},
 #line 173 "CSSValueKeywords.gperf"
       {"upper-alpha", CSSValueUpperAlpha},
-#line 399 "CSSValueKeywords.gperf"
+#line 403 "CSSValueKeywords.gperf"
       {"antiquewhite", CSSValueAntiquewhite},
 #line 115 "CSSValueKeywords.gperf"
       {"threeddarkshadow", CSSValueThreeddarkshadow},
-#line 534 "CSSValueKeywords.gperf"
+#line 537 "CSSValueKeywords.gperf"
       {"optimizequality", CSSValueOptimizequality},
 #line 148 "CSSValueKeywords.gperf"
       {"text-top", CSSValueTextTop},
-#line 441 "CSSValueKeywords.gperf"
+#line 445 "CSSValueKeywords.gperf"
       {"floralwhite", CSSValueFloralwhite},
 #line 178 "CSSValueKeywords.gperf"
       {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 369 "CSSValueKeywords.gperf"
+#line 370 "CSSValueKeywords.gperf"
       {"border-box", CSSValueBorderBox},
-#line 448 "CSSValueKeywords.gperf"
+#line 452 "CSSValueKeywords.gperf"
       {"honeydew", CSSValueHoneydew},
 #line 272 "CSSValueKeywords.gperf"
       {"overlay", CSSValueOverlay},
 #line 323 "CSSValueKeywords.gperf"
       {"break-word", CSSValueBreakWord},
-#line 458 "CSSValueKeywords.gperf"
+#line 462 "CSSValueKeywords.gperf"
       {"lightblue", CSSValueLightblue},
-#line 508 "CSSValueKeywords.gperf"
+#line 512 "CSSValueKeywords.gperf"
       {"sandybrown", CSSValueSandybrown},
-#line 504 "CSSValueKeywords.gperf"
+#line 508 "CSSValueKeywords.gperf"
       {"rosybrown", CSSValueRosybrown},
-#line 447 "CSSValueKeywords.gperf"
+#line 451 "CSSValueKeywords.gperf"
       {"greenyellow", CSSValueGreenyellow},
-#line 540 "CSSValueKeywords.gperf"
+#line 400 "CSSValueKeywords.gperf"
       {"optimizelegibility", CSSValueOptimizelegibility},
-#line 373 "CSSValueKeywords.gperf"
+#line 374 "CSSValueKeywords.gperf"
       {"padding-box", CSSValuePaddingBox},
 #line 182 "CSSValueKeywords.gperf"
       {"katakana-iroha", CSSValueKatakanaIroha},
 #line 321 "CSSValueKeywords.gperf"
       {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 478 "CSSValueKeywords.gperf"
+#line 482 "CSSValueKeywords.gperf"
       {"mediumorchid", CSSValueMediumorchid},
-#line 471 "CSSValueKeywords.gperf"
+#line 475 "CSSValueKeywords.gperf"
       {"lightsteelblue", CSSValueLightsteelblue},
-#line 463 "CSSValueKeywords.gperf"
+#line 467 "CSSValueKeywords.gperf"
       {"lightgreen", CSSValueLightgreen},
 #line 65 "CSSValueKeywords.gperf"
       {"semi-expanded", CSSValueSemiExpanded},
-#line 467 "CSSValueKeywords.gperf"
+#line 471 "CSSValueKeywords.gperf"
       {"lightseagreen", CSSValueLightseagreen},
-#line 351 "CSSValueKeywords.gperf"
+#line 352 "CSSValueKeywords.gperf"
       {"menulist-button", CSSValueMenulistButton},
-#line 354 "CSSValueKeywords.gperf"
+#line 355 "CSSValueKeywords.gperf"
       {"slider-horizontal", CSSValueSliderHorizontal},
 #line 128 "CSSValueKeywords.gperf"
       {"repeat-x", CSSValueRepeatX},
 #line 170 "CSSValueKeywords.gperf"
       {"lower-greek", CSSValueLowerGreek},
-#line 483 "CSSValueKeywords.gperf"
+#line 487 "CSSValueKeywords.gperf"
       {"mediumturquoise", CSSValueMediumturquoise},
 #line 171 "CSSValueKeywords.gperf"
       {"lower-alpha", CSSValueLowerAlpha},
@@ -1118,41 +1120,41 @@ findValue (register const char *str, register unsigned int len)
       {"graytext", CSSValueGraytext},
 #line 129 "CSSValueKeywords.gperf"
       {"repeat-y", CSSValueRepeatY},
-#line 498 "CSSValueKeywords.gperf"
+#line 502 "CSSValueKeywords.gperf"
       {"papayawhip", CSSValuePapayawhip},
-#line 364 "CSSValueKeywords.gperf"
+#line 365 "CSSValueKeywords.gperf"
       {"textfield", CSSValueTextfield},
 #line 149 "CSSValueKeywords.gperf"
       {"text-bottom", CSSValueTextBottom},
-#line 541 "CSSValueKeywords.gperf"
+#line 542 "CSSValueKeywords.gperf"
       {"before-edge", CSSValueBeforeEdge},
 #line 62 "CSSValueKeywords.gperf"
       {"extra-condensed", CSSValueExtraCondensed},
-#line 455 "CSSValueKeywords.gperf"
+#line 459 "CSSValueKeywords.gperf"
       {"lavenderblush", CSSValueLavenderblush},
-#line 345 "CSSValueKeywords.gperf"
+#line 346 "CSSValueKeywords.gperf"
       {"media-volume-slider", CSSValueMediaVolumeSlider},
 #line 26 "CSSValueKeywords.gperf"
       {"message-box", CSSValueMessageBox},
-#line 352 "CSSValueKeywords.gperf"
+#line 353 "CSSValueKeywords.gperf"
       {"menulist-text", CSSValueMenulistText},
-#line 482 "CSSValueKeywords.gperf"
+#line 486 "CSSValueKeywords.gperf"
       {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 460 "CSSValueKeywords.gperf"
+#line 464 "CSSValueKeywords.gperf"
       {"lightcyan", CSSValueLightcyan},
 #line 308 "CSSValueKeywords.gperf"
       {"read-write", CSSValueReadWrite},
 #line 258 "CSSValueKeywords.gperf"
       {"higher", CSSValueHigher},
-#line 526 "CSSValueKeywords.gperf"
+#line 530 "CSSValueKeywords.gperf"
       {"yellowgreen", CSSValueYellowgreen},
 #line 318 "CSSValueKeywords.gperf"
       {"dot-dot-dash", CSSValueDotDotDash},
-#line 457 "CSSValueKeywords.gperf"
+#line 461 "CSSValueKeywords.gperf"
       {"lemonchiffon", CSSValueLemonchiffon},
 #line 307 "CSSValueKeywords.gperf"
       {"read-only", CSSValueReadOnly},
-#line 359 "CSSValueKeywords.gperf"
+#line 360 "CSSValueKeywords.gperf"
       {"searchfield", CSSValueSearchfield},
 #line 181 "CSSValueKeywords.gperf"
       {"hiragana-iroha", CSSValueHiraganaIroha},
@@ -1162,7 +1164,7 @@ findValue (register const char *str, register unsigned int len)
       {"threedlightshadow", CSSValueThreedlightshadow},
 #line 201 "CSSValueKeywords.gperf"
       {"-wap-marquee", CSSValueWapMarquee},
-#line 336 "CSSValueKeywords.gperf"
+#line 337 "CSSValueKeywords.gperf"
       {"media-mute-button", CSSValueMediaMuteButton},
 #line 68 "CSSValueKeywords.gperf"
       {"ultra-expanded", CSSValueUltraExpanded},
@@ -1172,21 +1174,21 @@ findValue (register const char *str, register unsigned int len)
       {"-webkit-link", CSSValueWebkitLink},
 #line 167 "CSSValueKeywords.gperf"
       {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 357 "CSSValueKeywords.gperf"
+#line 358 "CSSValueKeywords.gperf"
       {"sliderthumb-vertical", CSSValueSliderthumbVertical},
 #line 94 "CSSValueKeywords.gperf"
       {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 472 "CSSValueKeywords.gperf"
+#line 476 "CSSValueKeywords.gperf"
       {"lightyellow", CSSValueLightyellow},
-#line 436 "CSSValueKeywords.gperf"
+#line 440 "CSSValueKeywords.gperf"
       {"deepskyblue", CSSValueDeepskyblue},
 #line 191 "CSSValueKeywords.gperf"
       {"table-row-group", CSSValueTableRowGroup},
-#line 343 "CSSValueKeywords.gperf"
+#line 344 "CSSValueKeywords.gperf"
       {"media-sliderthumb", CSSValueMediaSliderthumb},
 #line 160 "CSSValueKeywords.gperf"
       {"-webkit-center", CSSValueWebkitCenter},
-#line 338 "CSSValueKeywords.gperf"
+#line 339 "CSSValueKeywords.gperf"
       {"media-seek-back-button", CSSValueMediaSeekBackButton},
 #line 30 "CSSValueKeywords.gperf"
       {"-webkit-control", CSSValueWebkitControl},
@@ -1194,37 +1196,37 @@ findValue (register const char *str, register unsigned int len)
       {"line-through", CSSValueLineThrough},
 #line 153 "CSSValueKeywords.gperf"
       {"-webkit-auto", CSSValueWebkitAuto},
-#line 464 "CSSValueKeywords.gperf"
+#line 468 "CSSValueKeywords.gperf"
       {"lightgrey", CSSValueLightgrey},
-#line 462 "CSSValueKeywords.gperf"
+#line 466 "CSSValueKeywords.gperf"
       {"lightgray", CSSValueLightgray},
 #line 325 "CSSValueKeywords.gperf"
       {"after-white-space", CSSValueAfterWhiteSpace},
-#line 468 "CSSValueKeywords.gperf"
+#line 472 "CSSValueKeywords.gperf"
       {"lightskyblue", CSSValueLightskyblue},
-#line 499 "CSSValueKeywords.gperf"
+#line 503 "CSSValueKeywords.gperf"
       {"peachpuff", CSSValuePeachpuff},
-#line 337 "CSSValueKeywords.gperf"
+#line 338 "CSSValueKeywords.gperf"
       {"media-play-button", CSSValueMediaPlayButton},
-#line 340 "CSSValueKeywords.gperf"
+#line 341 "CSSValueKeywords.gperf"
       {"media-rewind-button", CSSValueMediaRewindButton},
 #line 117 "CSSValueKeywords.gperf"
       {"threedhighlight", CSSValueThreedhighlight},
 #line 67 "CSSValueKeywords.gperf"
       {"extra-expanded", CSSValueExtraExpanded},
-#line 470 "CSSValueKeywords.gperf"
+#line 474 "CSSValueKeywords.gperf"
       {"lightslategrey", CSSValueLightslategrey},
-#line 469 "CSSValueKeywords.gperf"
+#line 473 "CSSValueKeywords.gperf"
       {"lightslategray", CSSValueLightslategray},
 #line 214 "CSSValueKeywords.gperf"
       {"-webkit-zoom-in", CSSValueWebkitZoomIn},
 #line 193 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 353 "CSSValueKeywords.gperf"
+#line 354 "CSSValueKeywords.gperf"
       {"menulist-textfield", CSSValueMenulistTextfield},
 #line 158 "CSSValueKeywords.gperf"
       {"-webkit-left", CSSValueWebkitLeft},
-#line 344 "CSSValueKeywords.gperf"
+#line 345 "CSSValueKeywords.gperf"
       {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
 #line 105 "CSSValueKeywords.gperf"
       {"highlight", CSSValueHighlight},
@@ -1234,7 +1236,7 @@ findValue (register const char *str, register unsigned int len)
       {"table-header-group", CSSValueTableHeaderGroup},
 #line 266 "CSSValueKeywords.gperf"
       {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 347 "CSSValueKeywords.gperf"
+#line 348 "CSSValueKeywords.gperf"
       {"media-controls-background", CSSValueMediaControlsBackground},
 #line 234 "CSSValueKeywords.gperf"
       {"-webkit-grab", CSSValueWebkitGrab},
@@ -1244,7 +1246,7 @@ findValue (register const char *str, register unsigned int len)
       {"-webkit-text", CSSValueWebkitText},
 #line 28 "CSSValueKeywords.gperf"
       {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 335 "CSSValueKeywords.gperf"
+#line 336 "CSSValueKeywords.gperf"
       {"media-fullscreen-button", CSSValueMediaFullscreenButton},
 #line 215 "CSSValueKeywords.gperf"
       {"-webkit-zoom-out", CSSValueWebkitZoomOut},
@@ -1252,43 +1254,43 @@ findValue (register const char *str, register unsigned int len)
       {"buttonhighlight", CSSValueButtonhighlight},
 #line 199 "CSSValueKeywords.gperf"
       {"-webkit-box", CSSValueWebkitBox},
-#line 356 "CSSValueKeywords.gperf"
+#line 357 "CSSValueKeywords.gperf"
       {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
-#line 360 "CSSValueKeywords.gperf"
+#line 361 "CSSValueKeywords.gperf"
       {"searchfield-decoration", CSSValueSearchfieldDecoration},
 #line 152 "CSSValueKeywords.gperf"
       {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
-#line 346 "CSSValueKeywords.gperf"
+#line 347 "CSSValueKeywords.gperf"
       {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
 #line 74 "CSSValueKeywords.gperf"
       {"-webkit-body", CSSValueWebkitBody},
-#line 461 "CSSValueKeywords.gperf"
+#line 465 "CSSValueKeywords.gperf"
       {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 545 "CSSValueKeywords.gperf"
+#line 546 "CSSValueKeywords.gperf"
       {"text-after-edge", CSSValueTextAfterEdge},
-#line 349 "CSSValueKeywords.gperf"
+#line 350 "CSSValueKeywords.gperf"
       {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
 #line 159 "CSSValueKeywords.gperf"
       {"-webkit-right", CSSValueWebkitRight},
-#line 544 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
       {"text-before-edge", CSSValueTextBeforeEdge},
 #line 235 "CSSValueKeywords.gperf"
       {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 200 "CSSValueKeywords.gperf"
       {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 348 "CSSValueKeywords.gperf"
+#line 349 "CSSValueKeywords.gperf"
       {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
 #line 106 "CSSValueKeywords.gperf"
       {"highlighttext", CSSValueHighlighttext},
-#line 363 "CSSValueKeywords.gperf"
+#line 364 "CSSValueKeywords.gperf"
       {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 339 "CSSValueKeywords.gperf"
+#line 340 "CSSValueKeywords.gperf"
       {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 341 "CSSValueKeywords.gperf"
+#line 342 "CSSValueKeywords.gperf"
       {"media-return-to-realtime-button", CSSValueMediaReturnToRealtimeButton},
-#line 361 "CSSValueKeywords.gperf"
-      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
 #line 362 "CSSValueKeywords.gperf"
+      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
+#line 363 "CSSValueKeywords.gperf"
       {"searchfield-results-button", CSSValueSearchfieldResultsButton},
 #line 309 "CSSValueKeywords.gperf"
       {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
@@ -1470,223 +1472,223 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1, 317,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      319,  -1,  -1,  -1,  -1,  -1, 320,  -1,  -1,  -1,
-       -1, 321, 322,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 323,  -1,  -1, 324,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 325, 326,  -1, 327,
-       -1,  -1, 328,  -1,  -1, 329,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 330, 331,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 332,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 333,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 334,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 335,  -1,  -1,  -1,  -1, 336,  -1,  -1,  -1,
-       -1, 337,  -1,  -1,  -1,  -1,  -1, 338,  -1,  -1,
-       -1, 339,  -1,  -1,  -1, 340,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
-      342,  -1,  -1,  -1,  -1, 343,  -1,  -1,  -1,  -1,
-      344,  -1,  -1,  -1,  -1, 345, 346,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 347,  -1,  -1,  -1,
-       -1,  -1, 348,  -1,  -1,  -1, 349,  -1,  -1,  -1,
-       -1,  -1, 350,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 319,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      320,  -1,  -1,  -1,  -1,  -1, 321,  -1,  -1,  -1,
+       -1, 322, 323,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 324,  -1,  -1, 325,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 326, 327,  -1, 328,
+       -1,  -1, 329,  -1,  -1, 330,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 331, 332,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 333,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 334,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 335,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 336,  -1,  -1,  -1,  -1, 337,  -1,  -1,  -1,
+       -1, 338,  -1,  -1,  -1,  -1,  -1, 339,  -1,  -1,
+       -1, 340,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 342,  -1,  -1,  -1,  -1,
+      343,  -1,  -1,  -1,  -1, 344,  -1,  -1,  -1,  -1,
+      345,  -1,  -1,  -1,  -1, 346, 347,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 348,  -1,  -1,  -1,
+       -1,  -1, 349,  -1,  -1,  -1, 350,  -1,  -1,  -1,
        -1,  -1, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      352,  -1,  -1,  -1,  -1, 353, 354, 355,  -1,  -1,
-      356,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 357,  -1,  -1,
-       -1, 358,  -1,  -1,  -1,  -1, 359, 360, 361,  -1,
-       -1,  -1, 362,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 352,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      353,  -1,  -1,  -1,  -1, 354, 355, 356,  -1,  -1,
+      357,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 358,  -1,  -1,
+       -1, 359,  -1,  -1,  -1,  -1, 360, 361, 362,  -1,
        -1,  -1, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 364, 365,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 366,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 367, 368,  -1, 369, 370,  -1,  -1,  -1, 371,
-       -1, 372,  -1,  -1,  -1,  -1,  -1, 373,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 374,  -1,
-       -1, 375, 376,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 377,  -1, 378,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 364,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 365, 366,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 367,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 368, 369,  -1, 370, 371,  -1,  -1,  -1, 372,
+       -1, 373,  -1,  -1,  -1,  -1,  -1, 374,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 375,  -1,
+       -1, 376, 377,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 378,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 380,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 380, 381,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 381, 382,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      382,  -1, 383,  -1,  -1,  -1, 384, 385,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 386,  -1,
-       -1, 387,  -1, 388,  -1,  -1, 389,  -1,  -1,  -1,
+      383,  -1, 384,  -1,  -1,  -1, 385, 386,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 387,  -1,
+       -1, 388,  -1, 389,  -1,  -1, 390,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 390,  -1,  -1,  -1,
-       -1,  -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 391,  -1,  -1,  -1,
+       -1,  -1, 392,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      392,  -1, 393,  -1,  -1,  -1, 394, 395,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 396,  -1,  -1,  -1,
+      393,  -1, 394,  -1,  -1,  -1, 395, 396,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 398, 399, 400,  -1,
-       -1, 401,  -1,  -1,  -1, 402,  -1,  -1, 403,  -1,
-       -1,  -1,  -1,  -1,  -1, 404, 405,  -1,  -1,  -1,
-       -1,  -1, 406, 407,  -1,  -1, 408,  -1,  -1,  -1,
-       -1, 409,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 410,  -1,  -1,
-      411,  -1,  -1,  -1,  -1,  -1,  -1, 412, 413,  -1,
-       -1,  -1,  -1, 414,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 415,  -1,  -1,  -1,  -1, 416,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 417, 418,  -1, 419,  -1,
-       -1, 420,  -1,  -1, 421,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 398,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 399, 400, 401,  -1,
+       -1, 402,  -1,  -1,  -1, 403,  -1,  -1, 404,  -1,
+       -1,  -1,  -1,  -1,  -1, 405, 406,  -1,  -1,  -1,
+       -1,  -1, 407, 408,  -1,  -1, 409,  -1,  -1,  -1,
+       -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 411,  -1,  -1,
+      412,  -1,  -1,  -1,  -1,  -1,  -1, 413, 414,  -1,
+       -1,  -1,  -1, 415,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 416,  -1,  -1,  -1,  -1, 417,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 418, 419,  -1, 420,  -1,
+       -1, 421,  -1,  -1, 422,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 422,  -1,
-       -1,  -1,  -1, 423,  -1,  -1, 424,  -1,  -1,  -1,
-       -1,  -1, 425,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 423,  -1,
+       -1,  -1,  -1, 424,  -1,  -1, 425,  -1,  -1,  -1,
+       -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 432,  -1,  -1,  -1, 433, 434,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 435,  -1,  -1,
-       -1,  -1, 436,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 433,  -1,  -1,  -1, 434, 435,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,
+       -1,  -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 439,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 439,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,
-       -1,  -1,  -1,  -1, 441,  -1,  -1, 442,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 443,  -1,  -1,
-       -1,  -1, 444,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 445, 446, 447,  -1,  -1,
-       -1, 448,  -1,  -1,  -1,  -1,  -1, 449,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 441,  -1,
+       -1,  -1,  -1,  -1, 442,  -1,  -1, 443,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 444,  -1,  -1,
+       -1,  -1, 445,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 446, 447, 448,  -1,  -1,
+       -1, 449,  -1,  -1,  -1,  -1,  -1, 450,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      450, 451,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 452,  -1,  -1,  -1,  -1, 453,  -1,
+      451, 452,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 453,  -1,  -1,  -1,  -1, 454,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,
-       -1, 455,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      456,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 457,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 455,  -1,  -1,
+       -1, 456,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      457,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,
-       -1,  -1,  -1,  -1,  -1,  -1, 460,  -1,  -1,  -1,
-       -1, 461, 462,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 463,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 460,
+       -1,  -1,  -1,  -1,  -1,  -1, 461,  -1,  -1,  -1,
+       -1, 462, 463,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,
-       -1, 467,  -1,  -1,  -1,  -1,  -1, 468,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 467,  -1,  -1,
+       -1, 468,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
-       -1, 470,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 470,  -1,  -1,
        -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,
-      473,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,
+      474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      474, 475,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      475, 476,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,
-       -1, 478,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 480,  -1,
-      481,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 483,  -1, 484,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 478,  -1,  -1,
+       -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 481,  -1,
+      482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 483,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 484,  -1, 485,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 485,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 486,  -1,  -1,
-       -1,  -1,  -1,  -1, 487,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 487,  -1,  -1,
+       -1,  -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 491,  -1,  -1,  -1,  -1,
+       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 491,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 492,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1, 493,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1, 494,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,
-       -1,  -1, 496,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 496,  -1,  -1,
+       -1,  -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 497,  -1,
-       -1,  -1,  -1, 498,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,
+       -1,  -1,  -1, 499,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 499, 500,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 500, 501,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      501,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 503,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 504,  -1,  -1,
-       -1,  -1, 505,  -1,  -1,  -1,  -1,  -1, 506,  -1,
-       -1,  -1,  -1, 507,  -1,  -1,  -1, 508,  -1,  -1,
+       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,
+       -1,  -1, 506,  -1,  -1,  -1,  -1,  -1, 507,  -1,
+       -1,  -1,  -1, 508,  -1,  -1,  -1, 509,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 509,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1694,50 +1696,50 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 515,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 516,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 516,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 517,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 517, 518,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 518, 519,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 519,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,  -1,  -1,
+       -1,  -1, 522,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 523, 524,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,  -1,
+       -1,  -1, 524, 525,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 526,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 529,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1748,22 +1750,22 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 530,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 532,  -1,  -1,
+       -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1, 533,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1778,9 +1780,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1790,7 +1792,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1802,11 +1804,11 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,
-       -1,  -1,  -1,  -1,  -1, 540,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 540,  -1,
+       -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1834,7 +1836,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 542,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1856,7 +1858,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      542,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1877,7 +1879,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1891,7 +1893,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      545,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1924,7 +1926,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 545,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1950,7 +1952,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 547,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -2017,7 +2019,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 547
+       -1, 548
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -2039,7 +2041,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 559 "CSSValueKeywords.gperf"
+#line 560 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2365,6 +2367,7 @@ static const char * const valueList[] = {
 "button", 
 "button-bevel", 
 "default-button", 
+"list-button", 
 "listbox", 
 "listitem", 
 "media-fullscreen-button", 
@@ -2430,6 +2433,9 @@ static const char * const valueList[] = {
 "stroke", 
 "antialiased", 
 "subpixel-antialiased", 
+"optimizespeed", 
+"optimizelegibility", 
+"geometricprecision", 
 "aliceblue", 
 "antiquewhite", 
 "aquamarine", 
@@ -2565,14 +2571,11 @@ static const char * const valueList[] = {
 "new", 
 "srgb", 
 "linearrgb", 
-"optimizespeed", 
 "optimizequality", 
 "crispedges", 
-"geometricprecision", 
 "butt", 
 "miter", 
 "bevel", 
-"optimizelegibility", 
 "before-edge", 
 "after-edge", 
 "central", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index d3b22e4..e05d7ed 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -326,233 +326,234 @@ const int CSSValueSquareButton = 319;
 const int CSSValueButton = 320;
 const int CSSValueButtonBevel = 321;
 const int CSSValueDefaultButton = 322;
-const int CSSValueListbox = 323;
-const int CSSValueListitem = 324;
-const int CSSValueMediaFullscreenButton = 325;
-const int CSSValueMediaMuteButton = 326;
-const int CSSValueMediaPlayButton = 327;
-const int CSSValueMediaSeekBackButton = 328;
-const int CSSValueMediaSeekForwardButton = 329;
-const int CSSValueMediaRewindButton = 330;
-const int CSSValueMediaReturnToRealtimeButton = 331;
-const int CSSValueMediaSlider = 332;
-const int CSSValueMediaSliderthumb = 333;
-const int CSSValueMediaVolumeSliderContainer = 334;
-const int CSSValueMediaVolumeSlider = 335;
-const int CSSValueMediaVolumeSliderthumb = 336;
-const int CSSValueMediaControlsBackground = 337;
-const int CSSValueMediaCurrentTimeDisplay = 338;
-const int CSSValueMediaTimeRemainingDisplay = 339;
-const int CSSValueMenulist = 340;
-const int CSSValueMenulistButton = 341;
-const int CSSValueMenulistText = 342;
-const int CSSValueMenulistTextfield = 343;
-const int CSSValueSliderHorizontal = 344;
-const int CSSValueSliderVertical = 345;
-const int CSSValueSliderthumbHorizontal = 346;
-const int CSSValueSliderthumbVertical = 347;
-const int CSSValueCaret = 348;
-const int CSSValueSearchfield = 349;
-const int CSSValueSearchfieldDecoration = 350;
-const int CSSValueSearchfieldResultsDecoration = 351;
-const int CSSValueSearchfieldResultsButton = 352;
-const int CSSValueSearchfieldCancelButton = 353;
-const int CSSValueTextfield = 354;
-const int CSSValueTextarea = 355;
-const int CSSValueCapsLockIndicator = 356;
-const int CSSValueRound = 357;
-const int CSSValueBorder = 358;
-const int CSSValueBorderBox = 359;
-const int CSSValueContent = 360;
-const int CSSValueContentBox = 361;
-const int CSSValuePadding = 362;
-const int CSSValuePaddingBox = 363;
-const int CSSValueContain = 364;
-const int CSSValueCover = 365;
-const int CSSValueLogical = 366;
-const int CSSValueVisual = 367;
-const int CSSValueLines = 368;
-const int CSSValueRunning = 369;
-const int CSSValuePaused = 370;
-const int CSSValueFlat = 371;
-const int CSSValuePreserve3d = 372;
-const int CSSValueEase = 373;
-const int CSSValueLinear = 374;
-const int CSSValueEaseIn = 375;
-const int CSSValueEaseOut = 376;
-const int CSSValueEaseInOut = 377;
-const int CSSValueDocument = 378;
-const int CSSValueReset = 379;
-const int CSSValueVisiblepainted = 380;
-const int CSSValueVisiblefill = 381;
-const int CSSValueVisiblestroke = 382;
-const int CSSValuePainted = 383;
-const int CSSValueFill = 384;
-const int CSSValueStroke = 385;
-const int CSSValueAntialiased = 386;
-const int CSSValueSubpixelAntialiased = 387;
-const int CSSValueAliceblue = 388;
-const int CSSValueAntiquewhite = 389;
-const int CSSValueAquamarine = 390;
-const int CSSValueAzure = 391;
-const int CSSValueBeige = 392;
-const int CSSValueBisque = 393;
-const int CSSValueBlanchedalmond = 394;
-const int CSSValueBlueviolet = 395;
-const int CSSValueBrown = 396;
-const int CSSValueBurlywood = 397;
-const int CSSValueCadetblue = 398;
-const int CSSValueChartreuse = 399;
-const int CSSValueChocolate = 400;
-const int CSSValueCoral = 401;
-const int CSSValueCornflowerblue = 402;
-const int CSSValueCornsilk = 403;
-const int CSSValueCrimson = 404;
-const int CSSValueCyan = 405;
-const int CSSValueDarkblue = 406;
-const int CSSValueDarkcyan = 407;
-const int CSSValueDarkgoldenrod = 408;
-const int CSSValueDarkgray = 409;
-const int CSSValueDarkgreen = 410;
-const int CSSValueDarkgrey = 411;
-const int CSSValueDarkkhaki = 412;
-const int CSSValueDarkmagenta = 413;
-const int CSSValueDarkolivegreen = 414;
-const int CSSValueDarkorange = 415;
-const int CSSValueDarkorchid = 416;
-const int CSSValueDarkred = 417;
-const int CSSValueDarksalmon = 418;
-const int CSSValueDarkseagreen = 419;
-const int CSSValueDarkslateblue = 420;
-const int CSSValueDarkslategray = 421;
-const int CSSValueDarkslategrey = 422;
-const int CSSValueDarkturquoise = 423;
-const int CSSValueDarkviolet = 424;
-const int CSSValueDeeppink = 425;
-const int CSSValueDeepskyblue = 426;
-const int CSSValueDimgray = 427;
-const int CSSValueDimgrey = 428;
-const int CSSValueDodgerblue = 429;
-const int CSSValueFirebrick = 430;
-const int CSSValueFloralwhite = 431;
-const int CSSValueForestgreen = 432;
-const int CSSValueGainsboro = 433;
-const int CSSValueGhostwhite = 434;
-const int CSSValueGold = 435;
-const int CSSValueGoldenrod = 436;
-const int CSSValueGreenyellow = 437;
-const int CSSValueHoneydew = 438;
-const int CSSValueHotpink = 439;
-const int CSSValueIndianred = 440;
-const int CSSValueIndigo = 441;
-const int CSSValueIvory = 442;
-const int CSSValueKhaki = 443;
-const int CSSValueLavender = 444;
-const int CSSValueLavenderblush = 445;
-const int CSSValueLawngreen = 446;
-const int CSSValueLemonchiffon = 447;
-const int CSSValueLightblue = 448;
-const int CSSValueLightcoral = 449;
-const int CSSValueLightcyan = 450;
-const int CSSValueLightgoldenrodyellow = 451;
-const int CSSValueLightgray = 452;
-const int CSSValueLightgreen = 453;
-const int CSSValueLightgrey = 454;
-const int CSSValueLightpink = 455;
-const int CSSValueLightsalmon = 456;
-const int CSSValueLightseagreen = 457;
-const int CSSValueLightskyblue = 458;
-const int CSSValueLightslategray = 459;
-const int CSSValueLightslategrey = 460;
-const int CSSValueLightsteelblue = 461;
-const int CSSValueLightyellow = 462;
-const int CSSValueLimegreen = 463;
-const int CSSValueLinen = 464;
-const int CSSValueMagenta = 465;
-const int CSSValueMediumaquamarine = 466;
-const int CSSValueMediumblue = 467;
-const int CSSValueMediumorchid = 468;
-const int CSSValueMediumpurple = 469;
-const int CSSValueMediumseagreen = 470;
-const int CSSValueMediumslateblue = 471;
-const int CSSValueMediumspringgreen = 472;
-const int CSSValueMediumturquoise = 473;
-const int CSSValueMediumvioletred = 474;
-const int CSSValueMidnightblue = 475;
-const int CSSValueMintcream = 476;
-const int CSSValueMistyrose = 477;
-const int CSSValueMoccasin = 478;
-const int CSSValueNavajowhite = 479;
-const int CSSValueOldlace = 480;
-const int CSSValueOlivedrab = 481;
-const int CSSValueOrangered = 482;
-const int CSSValueOrchid = 483;
-const int CSSValuePalegoldenrod = 484;
-const int CSSValuePalegreen = 485;
-const int CSSValuePaleturquoise = 486;
-const int CSSValuePalevioletred = 487;
-const int CSSValuePapayawhip = 488;
-const int CSSValuePeachpuff = 489;
-const int CSSValuePeru = 490;
-const int CSSValuePink = 491;
-const int CSSValuePlum = 492;
-const int CSSValuePowderblue = 493;
-const int CSSValueRosybrown = 494;
-const int CSSValueRoyalblue = 495;
-const int CSSValueSaddlebrown = 496;
-const int CSSValueSalmon = 497;
-const int CSSValueSandybrown = 498;
-const int CSSValueSeagreen = 499;
-const int CSSValueSeashell = 500;
-const int CSSValueSienna = 501;
-const int CSSValueSkyblue = 502;
-const int CSSValueSlateblue = 503;
-const int CSSValueSlategray = 504;
-const int CSSValueSlategrey = 505;
-const int CSSValueSnow = 506;
-const int CSSValueSpringgreen = 507;
-const int CSSValueSteelblue = 508;
-const int CSSValueTan = 509;
-const int CSSValueThistle = 510;
-const int CSSValueTomato = 511;
-const int CSSValueTurquoise = 512;
-const int CSSValueViolet = 513;
-const int CSSValueWheat = 514;
-const int CSSValueWhitesmoke = 515;
-const int CSSValueYellowgreen = 516;
-const int CSSValueNonzero = 517;
-const int CSSValueEvenodd = 518;
-const int CSSValueAccumulate = 519;
-const int CSSValueNew = 520;
-const int CSSValueSrgb = 521;
-const int CSSValueLinearrgb = 522;
-const int CSSValueOptimizespeed = 523;
-const int CSSValueOptimizequality = 524;
-const int CSSValueCrispedges = 525;
-const int CSSValueGeometricprecision = 526;
-const int CSSValueButt = 527;
-const int CSSValueMiter = 528;
-const int CSSValueBevel = 529;
-const int CSSValueOptimizelegibility = 530;
-const int CSSValueBeforeEdge = 531;
-const int CSSValueAfterEdge = 532;
-const int CSSValueCentral = 533;
-const int CSSValueTextBeforeEdge = 534;
-const int CSSValueTextAfterEdge = 535;
-const int CSSValueIdeographic = 536;
-const int CSSValueAlphabetic = 537;
-const int CSSValueHanging = 538;
-const int CSSValueMathematical = 539;
-const int CSSValueUseScript = 540;
-const int CSSValueNoChange = 541;
-const int CSSValueResetSize = 542;
-const int CSSValueLrTb = 543;
-const int CSSValueRlTb = 544;
-const int CSSValueTbRl = 545;
-const int CSSValueLr = 546;
-const int CSSValueRl = 547;
-const int CSSValueTb = 548;
-const int numCSSValueKeywords = 549;
+const int CSSValueListButton = 323;
+const int CSSValueListbox = 324;
+const int CSSValueListitem = 325;
+const int CSSValueMediaFullscreenButton = 326;
+const int CSSValueMediaMuteButton = 327;
+const int CSSValueMediaPlayButton = 328;
+const int CSSValueMediaSeekBackButton = 329;
+const int CSSValueMediaSeekForwardButton = 330;
+const int CSSValueMediaRewindButton = 331;
+const int CSSValueMediaReturnToRealtimeButton = 332;
+const int CSSValueMediaSlider = 333;
+const int CSSValueMediaSliderthumb = 334;
+const int CSSValueMediaVolumeSliderContainer = 335;
+const int CSSValueMediaVolumeSlider = 336;
+const int CSSValueMediaVolumeSliderthumb = 337;
+const int CSSValueMediaControlsBackground = 338;
+const int CSSValueMediaCurrentTimeDisplay = 339;
+const int CSSValueMediaTimeRemainingDisplay = 340;
+const int CSSValueMenulist = 341;
+const int CSSValueMenulistButton = 342;
+const int CSSValueMenulistText = 343;
+const int CSSValueMenulistTextfield = 344;
+const int CSSValueSliderHorizontal = 345;
+const int CSSValueSliderVertical = 346;
+const int CSSValueSliderthumbHorizontal = 347;
+const int CSSValueSliderthumbVertical = 348;
+const int CSSValueCaret = 349;
+const int CSSValueSearchfield = 350;
+const int CSSValueSearchfieldDecoration = 351;
+const int CSSValueSearchfieldResultsDecoration = 352;
+const int CSSValueSearchfieldResultsButton = 353;
+const int CSSValueSearchfieldCancelButton = 354;
+const int CSSValueTextfield = 355;
+const int CSSValueTextarea = 356;
+const int CSSValueCapsLockIndicator = 357;
+const int CSSValueRound = 358;
+const int CSSValueBorder = 359;
+const int CSSValueBorderBox = 360;
+const int CSSValueContent = 361;
+const int CSSValueContentBox = 362;
+const int CSSValuePadding = 363;
+const int CSSValuePaddingBox = 364;
+const int CSSValueContain = 365;
+const int CSSValueCover = 366;
+const int CSSValueLogical = 367;
+const int CSSValueVisual = 368;
+const int CSSValueLines = 369;
+const int CSSValueRunning = 370;
+const int CSSValuePaused = 371;
+const int CSSValueFlat = 372;
+const int CSSValuePreserve3d = 373;
+const int CSSValueEase = 374;
+const int CSSValueLinear = 375;
+const int CSSValueEaseIn = 376;
+const int CSSValueEaseOut = 377;
+const int CSSValueEaseInOut = 378;
+const int CSSValueDocument = 379;
+const int CSSValueReset = 380;
+const int CSSValueVisiblepainted = 381;
+const int CSSValueVisiblefill = 382;
+const int CSSValueVisiblestroke = 383;
+const int CSSValuePainted = 384;
+const int CSSValueFill = 385;
+const int CSSValueStroke = 386;
+const int CSSValueAntialiased = 387;
+const int CSSValueSubpixelAntialiased = 388;
+const int CSSValueOptimizespeed = 389;
+const int CSSValueOptimizelegibility = 390;
+const int CSSValueGeometricprecision = 391;
+const int CSSValueAliceblue = 392;
+const int CSSValueAntiquewhite = 393;
+const int CSSValueAquamarine = 394;
+const int CSSValueAzure = 395;
+const int CSSValueBeige = 396;
+const int CSSValueBisque = 397;
+const int CSSValueBlanchedalmond = 398;
+const int CSSValueBlueviolet = 399;
+const int CSSValueBrown = 400;
+const int CSSValueBurlywood = 401;
+const int CSSValueCadetblue = 402;
+const int CSSValueChartreuse = 403;
+const int CSSValueChocolate = 404;
+const int CSSValueCoral = 405;
+const int CSSValueCornflowerblue = 406;
+const int CSSValueCornsilk = 407;
+const int CSSValueCrimson = 408;
+const int CSSValueCyan = 409;
+const int CSSValueDarkblue = 410;
+const int CSSValueDarkcyan = 411;
+const int CSSValueDarkgoldenrod = 412;
+const int CSSValueDarkgray = 413;
+const int CSSValueDarkgreen = 414;
+const int CSSValueDarkgrey = 415;
+const int CSSValueDarkkhaki = 416;
+const int CSSValueDarkmagenta = 417;
+const int CSSValueDarkolivegreen = 418;
+const int CSSValueDarkorange = 419;
+const int CSSValueDarkorchid = 420;
+const int CSSValueDarkred = 421;
+const int CSSValueDarksalmon = 422;
+const int CSSValueDarkseagreen = 423;
+const int CSSValueDarkslateblue = 424;
+const int CSSValueDarkslategray = 425;
+const int CSSValueDarkslategrey = 426;
+const int CSSValueDarkturquoise = 427;
+const int CSSValueDarkviolet = 428;
+const int CSSValueDeeppink = 429;
+const int CSSValueDeepskyblue = 430;
+const int CSSValueDimgray = 431;
+const int CSSValueDimgrey = 432;
+const int CSSValueDodgerblue = 433;
+const int CSSValueFirebrick = 434;
+const int CSSValueFloralwhite = 435;
+const int CSSValueForestgreen = 436;
+const int CSSValueGainsboro = 437;
+const int CSSValueGhostwhite = 438;
+const int CSSValueGold = 439;
+const int CSSValueGoldenrod = 440;
+const int CSSValueGreenyellow = 441;
+const int CSSValueHoneydew = 442;
+const int CSSValueHotpink = 443;
+const int CSSValueIndianred = 444;
+const int CSSValueIndigo = 445;
+const int CSSValueIvory = 446;
+const int CSSValueKhaki = 447;
+const int CSSValueLavender = 448;
+const int CSSValueLavenderblush = 449;
+const int CSSValueLawngreen = 450;
+const int CSSValueLemonchiffon = 451;
+const int CSSValueLightblue = 452;
+const int CSSValueLightcoral = 453;
+const int CSSValueLightcyan = 454;
+const int CSSValueLightgoldenrodyellow = 455;
+const int CSSValueLightgray = 456;
+const int CSSValueLightgreen = 457;
+const int CSSValueLightgrey = 458;
+const int CSSValueLightpink = 459;
+const int CSSValueLightsalmon = 460;
+const int CSSValueLightseagreen = 461;
+const int CSSValueLightskyblue = 462;
+const int CSSValueLightslategray = 463;
+const int CSSValueLightslategrey = 464;
+const int CSSValueLightsteelblue = 465;
+const int CSSValueLightyellow = 466;
+const int CSSValueLimegreen = 467;
+const int CSSValueLinen = 468;
+const int CSSValueMagenta = 469;
+const int CSSValueMediumaquamarine = 470;
+const int CSSValueMediumblue = 471;
+const int CSSValueMediumorchid = 472;
+const int CSSValueMediumpurple = 473;
+const int CSSValueMediumseagreen = 474;
+const int CSSValueMediumslateblue = 475;
+const int CSSValueMediumspringgreen = 476;
+const int CSSValueMediumturquoise = 477;
+const int CSSValueMediumvioletred = 478;
+const int CSSValueMidnightblue = 479;
+const int CSSValueMintcream = 480;
+const int CSSValueMistyrose = 481;
+const int CSSValueMoccasin = 482;
+const int CSSValueNavajowhite = 483;
+const int CSSValueOldlace = 484;
+const int CSSValueOlivedrab = 485;
+const int CSSValueOrangered = 486;
+const int CSSValueOrchid = 487;
+const int CSSValuePalegoldenrod = 488;
+const int CSSValuePalegreen = 489;
+const int CSSValuePaleturquoise = 490;
+const int CSSValuePalevioletred = 491;
+const int CSSValuePapayawhip = 492;
+const int CSSValuePeachpuff = 493;
+const int CSSValuePeru = 494;
+const int CSSValuePink = 495;
+const int CSSValuePlum = 496;
+const int CSSValuePowderblue = 497;
+const int CSSValueRosybrown = 498;
+const int CSSValueRoyalblue = 499;
+const int CSSValueSaddlebrown = 500;
+const int CSSValueSalmon = 501;
+const int CSSValueSandybrown = 502;
+const int CSSValueSeagreen = 503;
+const int CSSValueSeashell = 504;
+const int CSSValueSienna = 505;
+const int CSSValueSkyblue = 506;
+const int CSSValueSlateblue = 507;
+const int CSSValueSlategray = 508;
+const int CSSValueSlategrey = 509;
+const int CSSValueSnow = 510;
+const int CSSValueSpringgreen = 511;
+const int CSSValueSteelblue = 512;
+const int CSSValueTan = 513;
+const int CSSValueThistle = 514;
+const int CSSValueTomato = 515;
+const int CSSValueTurquoise = 516;
+const int CSSValueViolet = 517;
+const int CSSValueWheat = 518;
+const int CSSValueWhitesmoke = 519;
+const int CSSValueYellowgreen = 520;
+const int CSSValueNonzero = 521;
+const int CSSValueEvenodd = 522;
+const int CSSValueAccumulate = 523;
+const int CSSValueNew = 524;
+const int CSSValueSrgb = 525;
+const int CSSValueLinearrgb = 526;
+const int CSSValueOptimizequality = 527;
+const int CSSValueCrispedges = 528;
+const int CSSValueButt = 529;
+const int CSSValueMiter = 530;
+const int CSSValueBevel = 531;
+const int CSSValueBeforeEdge = 532;
+const int CSSValueAfterEdge = 533;
+const int CSSValueCentral = 534;
+const int CSSValueTextBeforeEdge = 535;
+const int CSSValueTextAfterEdge = 536;
+const int CSSValueIdeographic = 537;
+const int CSSValueAlphabetic = 538;
+const int CSSValueHanging = 539;
+const int CSSValueMathematical = 540;
+const int CSSValueUseScript = 541;
+const int CSSValueNoChange = 542;
+const int CSSValueResetSize = 543;
+const int CSSValueLrTb = 544;
+const int CSSValueRlTb = 545;
+const int CSSValueTbRl = 546;
+const int CSSValueLr = 547;
+const int CSSValueRl = 548;
+const int CSSValueTb = 549;
+const int numCSSValueKeywords = 550;
 const size_t maxCSSValueKeywordLength = 31;
 
 const char* getValueName(unsigned short id);
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 973f104..ee402fc 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -236,6 +236,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -257,7 +258,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 4e51f54..06d1f1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -409,6 +409,7 @@ DEFINE_GLOBAL(QualifiedName, objectAttr, nullAtom, "object", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onabortAttr, nullAtom, "onabort", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforecopyAttr, nullAtom, "onbeforecopy", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforecutAttr, nullAtom, "onbeforecut", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onbeforeloadAttr, nullAtom, "onbeforeload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforepasteAttr, nullAtom, "onbeforepaste", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforeunloadAttr, nullAtom, "onbeforeunload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onblurAttr, nullAtom, "onblur", xhtmlNamespaceURI);
@@ -441,7 +442,6 @@ DEFINE_GLOBAL(QualifiedName, onkeyupAttr, nullAtom, "onkeyup", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, onloadAttr, nullAtom, "onload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadeddataAttr, nullAtom, "onloadeddata", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadedmetadataAttr, nullAtom, "onloadedmetadata", xhtmlNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, onloadendAttr, nullAtom, "onloadend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadstartAttr, nullAtom, "onloadstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousedownAttr, nullAtom, "onmousedown", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousemoveAttr, nullAtom, "onmousemove", xhtmlNamespaceURI);
@@ -661,6 +661,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onabortAttr,
         (WebCore::QualifiedName*)&onbeforecopyAttr,
         (WebCore::QualifiedName*)&onbeforecutAttr,
+        (WebCore::QualifiedName*)&onbeforeloadAttr,
         (WebCore::QualifiedName*)&onbeforepasteAttr,
         (WebCore::QualifiedName*)&onbeforeunloadAttr,
         (WebCore::QualifiedName*)&onblurAttr,
@@ -693,7 +694,6 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onloadAttr,
         (WebCore::QualifiedName*)&onloadeddataAttr,
         (WebCore::QualifiedName*)&onloadedmetadataAttr,
-        (WebCore::QualifiedName*)&onloadendAttr,
         (WebCore::QualifiedName*)&onloadstartAttr,
         (WebCore::QualifiedName*)&onmousedownAttr,
         (WebCore::QualifiedName*)&onmousemoveAttr,
@@ -1166,6 +1166,7 @@ void init()
     const char *onabortAttrString = "onabort";
     const char *onbeforecopyAttrString = "onbeforecopy";
     const char *onbeforecutAttrString = "onbeforecut";
+    const char *onbeforeloadAttrString = "onbeforeload";
     const char *onbeforepasteAttrString = "onbeforepaste";
     const char *onbeforeunloadAttrString = "onbeforeunload";
     const char *onblurAttrString = "onblur";
@@ -1198,7 +1199,6 @@ void init()
     const char *onloadAttrString = "onload";
     const char *onloadeddataAttrString = "onloadeddata";
     const char *onloadedmetadataAttrString = "onloadedmetadata";
-    const char *onloadendAttrString = "onloadend";
     const char *onloadstartAttrString = "onloadstart";
     const char *onmousedownAttrString = "onmousedown";
     const char *onmousemoveAttrString = "onmousemove";
@@ -1413,6 +1413,7 @@ void init()
     new ((void*)&onabortAttr) QualifiedName(nullAtom, onabortAttrString, nullAtom);
     new ((void*)&onbeforecopyAttr) QualifiedName(nullAtom, onbeforecopyAttrString, nullAtom);
     new ((void*)&onbeforecutAttr) QualifiedName(nullAtom, onbeforecutAttrString, nullAtom);
+    new ((void*)&onbeforeloadAttr) QualifiedName(nullAtom, onbeforeloadAttrString, nullAtom);
     new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, onbeforepasteAttrString, nullAtom);
     new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, onbeforeunloadAttrString, nullAtom);
     new ((void*)&onblurAttr) QualifiedName(nullAtom, onblurAttrString, nullAtom);
@@ -1445,7 +1446,6 @@ void init()
     new ((void*)&onloadAttr) QualifiedName(nullAtom, onloadAttrString, nullAtom);
     new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, onloadeddataAttrString, nullAtom);
     new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, onloadedmetadataAttrString, nullAtom);
-    new ((void*)&onloadendAttr) QualifiedName(nullAtom, onloadendAttrString, nullAtom);
     new ((void*)&onloadstartAttr) QualifiedName(nullAtom, onloadstartAttrString, nullAtom);
     new ((void*)&onmousedownAttr) QualifiedName(nullAtom, onmousedownAttrString, nullAtom);
     new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, onmousemoveAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index d7d327f..6fd108e 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -280,6 +280,7 @@ extern const WebCore::QualifiedName objectAttr;
 extern const WebCore::QualifiedName onabortAttr;
 extern const WebCore::QualifiedName onbeforecopyAttr;
 extern const WebCore::QualifiedName onbeforecutAttr;
+extern const WebCore::QualifiedName onbeforeloadAttr;
 extern const WebCore::QualifiedName onbeforepasteAttr;
 extern const WebCore::QualifiedName onbeforeunloadAttr;
 extern const WebCore::QualifiedName onblurAttr;
@@ -312,7 +313,6 @@ extern const WebCore::QualifiedName onkeyupAttr;
 extern const WebCore::QualifiedName onloadAttr;
 extern const WebCore::QualifiedName onloadeddataAttr;
 extern const WebCore::QualifiedName onloadedmetadataAttr;
-extern const WebCore::QualifiedName onloadendAttr;
 extern const WebCore::QualifiedName onloadstartAttr;
 extern const WebCore::QualifiedName onmousedownAttr;
 extern const WebCore::QualifiedName onmousemoveAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index 1bc76c7..d472340 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSAbstractWorkerConstructor::s_info = { "AbstractWorkerConstructor", 0, &JSAbstractWorkerConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
index a4232c5..882c091 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -60,6 +60,8 @@ public:
 
 private:
     RefPtr<AbstractWorker> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, AbstractWorker*);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSAbstractWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index b8a69a5..89cfed1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSAttrConstructor::s_info = { "AttrConstructor", 0, &JSAttrConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index f1aa7af..1562011 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,6 +54,8 @@ public:
     {
         return static_cast<Attr*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 Attr* toAttr(JSC::JSValue);
@@ -66,9 +68,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSAttrPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index 7f11801..9c389a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     BarInfo* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<BarInfo> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, BarInfo*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSBarInfoPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
new file mode 100644
index 0000000..a7ec577
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
@@ -0,0 +1,188 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSBeforeLoadEvent.h"
+
+#include "BeforeLoadEvent.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSBeforeLoadEvent);
+
+/* Hash table */
+
+static const HashTableValue JSBeforeLoadEventTableValues[3] =
+{
+    { "url", DontDelete|ReadOnly, (intptr_t)jsBeforeLoadEventUrl, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsBeforeLoadEventConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBeforeLoadEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSBeforeLoadEventTableValues, 0 };
+#else
+    { 4, 3, JSBeforeLoadEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSBeforeLoadEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBeforeLoadEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBeforeLoadEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSBeforeLoadEventConstructorTableValues, 0 };
+#endif
+
+class JSBeforeLoadEventConstructor : public DOMConstructorObject {
+public:
+    JSBeforeLoadEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSBeforeLoadEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSBeforeLoadEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSBeforeLoadEventConstructor::s_info = { "BeforeLoadEventConstructor", 0, &JSBeforeLoadEventConstructorTable, 0 };
+
+bool JSBeforeLoadEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBeforeLoadEventConstructor, DOMObject>(exec, &JSBeforeLoadEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSBeforeLoadEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBeforeLoadEventConstructor, DOMObject>(exec, &JSBeforeLoadEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSBeforeLoadEventPrototypeTableValues[2] =
+{
+    { "initBeforeLoadEvent", DontDelete|Function, (intptr_t)jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent, (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBeforeLoadEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBeforeLoadEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSBeforeLoadEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSBeforeLoadEventPrototype::s_info = { "BeforeLoadEventPrototype", 0, &JSBeforeLoadEventPrototypeTable, 0 };
+
+JSObject* JSBeforeLoadEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSBeforeLoadEvent>(exec, globalObject);
+}
+
+bool JSBeforeLoadEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSBeforeLoadEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSBeforeLoadEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSBeforeLoadEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSBeforeLoadEvent::s_info = { "BeforeLoadEvent", &JSEvent::s_info, &JSBeforeLoadEventTable, 0 };
+
+JSBeforeLoadEvent::JSBeforeLoadEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<BeforeLoadEvent> impl)
+    : JSEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSBeforeLoadEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSBeforeLoadEventPrototype(JSBeforeLoadEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
+}
+
+bool JSBeforeLoadEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBeforeLoadEvent, Base>(exec, &JSBeforeLoadEventTable, this, propertyName, slot);
+}
+
+bool JSBeforeLoadEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBeforeLoadEvent, Base>(exec, &JSBeforeLoadEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsBeforeLoadEventUrl(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSBeforeLoadEvent* castedThis = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    BeforeLoadEvent* imp = static_cast<BeforeLoadEvent*>(castedThis->impl());
+    return jsString(exec, imp->url());
+}
+
+JSValue jsBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSBeforeLoadEvent* domObject = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    return JSBeforeLoadEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSBeforeLoadEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSBeforeLoadEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSBeforeLoadEvent::s_info))
+        return throwError(exec, TypeError);
+    JSBeforeLoadEvent* castedThisObj = static_cast<JSBeforeLoadEvent*>(asObject(thisValue));
+    BeforeLoadEvent* imp = static_cast<BeforeLoadEvent*>(castedThisObj->impl());
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    const UString& url = args.at(3).toString(exec);
+
+    imp->initBeforeLoadEvent(type, canBubble, cancelable, url);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
new file mode 100644
index 0000000..e575192
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSBeforeLoadEvent_h
+#define JSBeforeLoadEvent_h
+
+#include "JSEvent.h"
+
+namespace WebCore {
+
+class BeforeLoadEvent;
+
+class JSBeforeLoadEvent : public JSEvent {
+    typedef JSEvent Base;
+public:
+    JSBeforeLoadEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<BeforeLoadEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSBeforeLoadEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+    JSBeforeLoadEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsBeforeLoadEventUrl(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index 01b4c11..bdc4a93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -73,8 +73,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCDATASectionConstructor::s_info = { "CDATASectionConstructor", 0, &JSCDATASectionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index 8d1352c..80b824c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJSNewlyCreated(JSC::ExecState*, JSDOMGlobalObject*, CDATASection*);
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCDATASectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 83f4a64..52c01c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -75,8 +75,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSCharsetRuleConstructor::s_info = { "CSSCharsetRuleConstructor", 0, &JSCSSCharsetRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 9ad4e9c..971cfb1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSCharsetRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 38b6fce..012e437 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSFontFaceRuleConstructor::s_info = { "CSSFontFaceRuleConstructor", 0, &JSCSSFontFaceRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index c99c45d..6a6acb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSFontFaceRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index c23f7fe..e3ae983 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSImportRuleConstructor::s_info = { "CSSImportRuleConstructor", 0, &JSCSSImportRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index 5e73495..14e289a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSImportRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index e0c713b..fbb26e8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSMediaRuleConstructor::s_info = { "CSSMediaRuleConstructor", 0, &JSCSSMediaRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 3751a8e..225e70a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSMediaRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index 1d94046..b1da3b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSPageRuleConstructor::s_info = { "CSSPageRuleConstructor", 0, &JSCSSPageRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index d62bc67..8ba0942 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSPageRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index ee2288d..ea0517c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -110,8 +110,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSPrimitiveValueConstructor::s_info = { "CSSPrimitiveValueConstructor", 0, &JSCSSPrimitiveValueConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index a2cec7c..c015d4c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSPrimitiveValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 02231b7..307b17a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -92,8 +92,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSRuleConstructor::s_info = { "CSSRuleConstructor", 0, &JSCSSRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index 4df85da..afc609c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<CSSRule> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSRule*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 3c7bb93..e02a6ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSRuleListConstructor::s_info = { "CSSRuleListConstructor", 0, &JSCSSRuleListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index 5f61961..8b4a59d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<CSSRuleList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -71,9 +73,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSRuleListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 63cd7a5..6292b64 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSStyleDeclarationConstructor::s_info = { "CSSStyleDeclarationConstructor", 0, &JSCSSStyleDeclarationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index bf9f943..48c6a9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<CSSStyleDeclaration> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, CSSStyleDeclaration*, const JSC::Identifier&);
@@ -76,9 +78,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSStyleDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index aa27d94..d44bb5c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSStyleRuleConstructor::s_info = { "CSSStyleRuleConstructor", 0, &JSCSSStyleRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index 9955974..fc72cbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSStyleRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index 4073c6f..e2d45bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSStyleSheetConstructor::s_info = { "CSSStyleSheetConstructor", 0, &JSCSSStyleSheetConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index a807b47..4df8ea3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 6f61adb..22f6c30 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSValueConstructor::s_info = { "CSSValueConstructor", 0, &JSCSSValueConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index ceec3aa..cd54be1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<CSSValue> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSValue*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index 56afec2..3e78786 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSValueListConstructor::s_info = { "CSSValueListConstructor", 0, &JSCSSValueListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index 8603e87..c57887e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -40,11 +40,13 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSValueListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 65f225f..ef1d726 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSVariablesDeclarationConstructor::s_info = { "CSSVariablesDeclarationConstructor", 0, &JSCSSVariablesDeclarationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index dff45a3..1eee675 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<CSSVariablesDeclaration> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCSSVariablesDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 2c61ec7..4888123 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCSSVariablesRuleConstructor::s_info = { "CSSVariablesRuleConstructor", 0, &JSCSSVariablesRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index 6248363..f3bee08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCSSVariablesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
index 26409c8..aeeeb4f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
@@ -145,10 +145,6 @@ JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(ExecState
     return result;
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasArray>(exec, globalObject, object);
-}
 CanvasArray* toCanvasArray(JSC::JSValue value)
 {
     return value.inherits(&JSCanvasArray::s_info) ? static_cast<JSCanvasArray*>(asObject(value))->impl() : 0;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
index 0a12328..0d67612 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     CanvasArray* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArray*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
index 16a3945..eff168f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     CanvasArrayBuffer* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasArrayBuffer> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArrayBuffer*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasArrayBufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
index 0c30bfd..c76c679 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasByteArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
index 347e334..c96508e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasFloatArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasFloatArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index 6d5c822..bd7aa3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -39,10 +39,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     CanvasGradient* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasGradient> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasGradient*);
@@ -58,9 +65,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasGradientPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
index e0358dd..f4deadf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasIntArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
index e7d0a9c..7574813 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
@@ -39,10 +39,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     CanvasPattern* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasPattern> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasPattern*);
@@ -54,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasPatternPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
index ad807c6..1d06dfe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCanvasRenderingContextConstructor::s_info = { "CanvasRenderingContextConstructor", 0, &JSCanvasRenderingContextConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
index 7b6ca92..a8b56a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<CanvasRenderingContext> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasRenderingContext*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasRenderingContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index dc8d58f..97b4d72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCanvasRenderingContext2DConstructor::s_info = { "CanvasRenderingContext2DConstructor", 0, &JSCanvasRenderingContext2DConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index 03008b6..5637651 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,6 +62,8 @@ public:
     JSC::JSValue setShadow(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue createPattern(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue putImageData(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasRenderingContext2DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
index ff9f7b6..7ed7f05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
@@ -24,6 +24,8 @@
 
 #include "JSCanvasRenderingContext3D.h"
 
+#include "CanvasActiveInfo.h"
+#include "CanvasArray.h"
 #include "CanvasBuffer.h"
 #include "CanvasFloatArray.h"
 #include "CanvasFramebuffer.h"
@@ -34,6 +36,8 @@
 #include "CanvasShader.h"
 #include "CanvasTexture.h"
 #include "CanvasUnsignedByteArray.h"
+#include "JSCanvasActiveInfo.h"
+#include "JSCanvasArray.h"
 #include "JSCanvasBuffer.h"
 #include "JSCanvasFloatArray.h"
 #include "JSCanvasFramebuffer.h"
@@ -400,8 +404,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCanvasRenderingContext3DConstructor::s_info = { "CanvasRenderingContext3DConstructor", 0, &JSCanvasRenderingContext3DConstructorTable, 0 };
@@ -418,7 +425,7 @@ bool JSCanvasRenderingContext3DConstructor::getOwnPropertyDescriptor(ExecState*
 
 /* Hash table for prototype */
 
-static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450] =
+static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[453] =
 {
     { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
     { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
@@ -775,6 +782,8 @@ static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450]
     { "framebufferTexture2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D, (intptr_t)5 },
     { "frontFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFrontFace, (intptr_t)1 },
     { "generateMipmap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap, (intptr_t)1 },
+    { "getActiveAttrib", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib, (intptr_t)2 },
+    { "getActiveUniform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform, (intptr_t)2 },
     { "getAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation, (intptr_t)2 },
     { "getBoolean", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBoolean, (intptr_t)1 },
     { "getBooleanv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv, (intptr_t)1 },
@@ -823,6 +832,7 @@ static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450]
     { "linkProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLinkProgram, (intptr_t)1 },
     { "pixelStorei", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPixelStorei, (intptr_t)2 },
     { "polygonOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset, (intptr_t)2 },
+    { "readPixels", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReadPixels, (intptr_t)6 },
     { "releaseShaderCompiler", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler, (intptr_t)0 },
     { "renderbufferStorage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage, (intptr_t)4 },
     { "sampleCoverage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage, (intptr_t)2 },
@@ -876,7 +886,7 @@ static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 65535, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
 #else
-    { 1103, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
+    { 1104, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSCanvasRenderingContext3DPrototype::s_info = { "CanvasRenderingContext3DPrototype", 0, &JSCanvasRenderingContext3DPrototypeTable, 0 };
@@ -1661,6 +1671,40 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveAttrib(program, index, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveUniform(program, index, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -2357,6 +2401,25 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(E
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+    unsigned format = args.at(4).toInt32(exec);
+    unsigned type = args.at(5).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->readPixels(x, y, width, height, format, type)));
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
index 6833836..75ad4d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,6 +66,8 @@ public:
     JSC::JSValue vertexAttrib2fv(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue vertexAttrib3fv(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue vertexAttrib4fv(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -79,9 +81,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCanvasRenderingContext3DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -139,6 +143,8 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebuffe
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -187,6 +193,7 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
index b5b4aa5..688ca0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasShortArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
index 9e9b643..ccfaef6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasUnsignedByteArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasUnsignedByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
index 916f08f..c53c7ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasUnsignedIntArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasUnsignedIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
index c2d3efb..e9e5127 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<CanvasUnsignedShortArray*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -66,7 +68,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCanvasUnsignedShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index 2e261cd..2148888 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCharacterDataConstructor::s_info = { "CharacterDataConstructor", 0, &JSCharacterDataConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index 11d2aab..f06e22b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSCharacterDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index e871f45..175d660 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSClientRectConstructor::s_info = { "ClientRectConstructor", 0, &JSClientRectConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
index 2ed96dd..18962f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<ClientRect> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ClientRect*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSClientRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index 2dd60cc..143ee8c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSClientRectListConstructor::s_info = { "ClientRectListConstructor", 0, &JSClientRectListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
index 6149018..ce8cb3f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<ClientRectList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSClientRectListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 22ff137..f72e341 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSClipboardConstructor::s_info = { "ClipboardConstructor", 0, &JSClipboardConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index d4a5532..e4458a7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,6 +61,8 @@ public:
 
 private:
     RefPtr<Clipboard> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Clipboard*);
@@ -76,9 +78,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSClipboardPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index 323c771..770a3f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -73,8 +73,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCommentConstructor::s_info = { "CommentConstructor", 0, &JSCommentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index 79c47c4..e88ddf4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCommentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index c933ca9..c55cc0e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<Console> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Console*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSConsolePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
index 3de9a5b..be0408b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<Coordinates> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Coordinates*);
@@ -67,7 +69,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCoordinatesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index c8ba9f9..d17a368 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSCounterConstructor::s_info = { "CounterConstructor", 0, &JSCounterConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index ffc98ba2..9827a48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Counter> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Counter*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSCounterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index d306322..2ee87d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
 
 private:
     RefPtr<DOMApplicationCache> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMApplicationCache*);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMApplicationCachePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index c909c02..d625e2b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -102,8 +102,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDOMCoreExceptionConstructor::s_info = { "DOMExceptionConstructor", 0, &JSDOMCoreExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index 116ac2e..0d99c15 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<DOMCoreException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMCoreException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMCoreExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 588e21b..62eef6c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDOMImplementationConstructor::s_info = { "DOMImplementationConstructor", 0, &JSDOMImplementationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index 755f035..8dc907f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<DOMImplementation> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMImplementation*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMImplementationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index ff99782..4af88cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
     static JSObject* constructDOMParser(ExecState* exec, JSObject* constructor, const ArgList&)
     {
         return asObject(toJS(exec, static_cast<JSDOMParserConstructor*>(constructor)->globalObject(), DOMParser::create()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index ff7f395..8788ff2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<DOMParser> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMParser*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMParserPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index e26b627..863723f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     DOMSelection* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMSelection> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMSelection*);
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMSelectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index 24fc1de..dc53217 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -36,6 +36,7 @@
 #include "EventListener.h"
 #include "JSAttr.h"
 #include "JSBarInfo.h"
+#include "JSBeforeLoadEvent.h"
 #include "JSCDATASection.h"
 #include "JSCSSCharsetRule.h"
 #include "JSCSSFontFaceRule.h"
@@ -245,7 +246,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[295] =
+static const HashTableValue JSDOMWindowTableValues[296] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -499,6 +500,7 @@ static const HashTableValue JSDOMWindowTableValues[295] =
     { "CanvasFloatArray", DontDelete, (intptr_t)jsDOMWindowCanvasFloatArrayConstructor, (intptr_t)setJSDOMWindowCanvasFloatArrayConstructor },
 #endif
     { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
+    { "BeforeLoadEvent", DontDelete, (intptr_t)jsDOMWindowBeforeLoadEventConstructor, (intptr_t)setJSDOMWindowBeforeLoadEventConstructor },
     { "KeyboardEvent", DontDelete, (intptr_t)jsDOMWindowKeyboardEventConstructor, (intptr_t)setJSDOMWindowKeyboardEventConstructor },
     { "MouseEvent", DontDelete, (intptr_t)jsDOMWindowMouseEventConstructor, (intptr_t)setJSDOMWindowMouseEventConstructor },
     { "MutationEvent", DontDelete, (intptr_t)jsDOMWindowMutationEventConstructor, (intptr_t)setJSDOMWindowMutationEventConstructor },
@@ -2974,6 +2976,14 @@ JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const Pr
     return JSEvent::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSBeforeLoadEvent::getConstructor(exec, castedThis);
+}
+
 JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -5363,6 +5373,14 @@ void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSVal
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
 }
 
+void setJSDOMWindowBeforeLoadEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "BeforeLoadEvent"), value);
+}
+
 void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index 75a1e50..232c8eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -99,6 +99,8 @@ public:
     {
         return static_cast<DOMWindow*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::ImplementsHasInstance | JSC::NeedsThisConversion | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 DOMWindow* toDOMWindow(JSC::JSValue);
@@ -113,9 +115,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDOMWindowPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -601,6 +605,8 @@ JSC::JSValue jsDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, const JSC::
 void setJSDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 15ae6c3..586edd1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -91,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDataGridColumnConstructor::s_info = { "DataGridColumnConstructor", 0, &JSDataGridColumnConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
index 515b549..c53c99d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<DataGridColumn> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DataGridColumn*);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDataGridColumnPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index dc8e05f..08585fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDataGridColumnListConstructor::s_info = { "DataGridColumnListConstructor", 0, &JSDataGridColumnListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
index 0c3f10f..ac4d33e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<DataGridColumnList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDataGridColumnListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index d902ced..0353427 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<Database> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Database*);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDatabasePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
index b3591bf..2e65842 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -52,6 +52,8 @@ public:
     {
         return static_cast<DedicatedWorkerContext*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 DedicatedWorkerContext* toDedicatedWorkerContext(JSC::JSValue);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDedicatedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 5017f30..47a2936 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -39,6 +39,7 @@
 #include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
+#include "HTMLHeadElement.h"
 #include "JSAttr.h"
 #include "JSCDATASection.h"
 #include "JSCSSStyleDeclaration.h"
@@ -57,6 +58,7 @@
 #include "JSEventListener.h"
 #include "JSHTMLCollection.h"
 #include "JSHTMLElement.h"
+#include "JSHTMLHeadElement.h"
 #include "JSNode.h"
 #include "JSNodeFilter.h"
 #include "JSNodeIterator.h"
@@ -96,7 +98,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
-static const HashTableValue JSDocumentTableValues[70] =
+static const HashTableValue JSDocumentTableValues[71] =
 {
     { "doctype", DontDelete|ReadOnly, (intptr_t)jsDocumentDoctype, (intptr_t)0 },
     { "implementation", DontDelete|ReadOnly, (intptr_t)jsDocumentImplementation, (intptr_t)0 },
@@ -114,6 +116,7 @@ static const HashTableValue JSDocumentTableValues[70] =
     { "URL", DontDelete|ReadOnly, (intptr_t)jsDocumentURL, (intptr_t)0 },
     { "cookie", DontDelete, (intptr_t)jsDocumentCookie, (intptr_t)setJSDocumentCookie },
     { "body", DontDelete, (intptr_t)jsDocumentBody, (intptr_t)setJSDocumentBody },
+    { "head", DontDelete|ReadOnly, (intptr_t)jsDocumentHead, (intptr_t)0 },
     { "images", DontDelete|ReadOnly, (intptr_t)jsDocumentImages, (intptr_t)0 },
     { "applets", DontDelete|ReadOnly, (intptr_t)jsDocumentApplets, (intptr_t)0 },
     { "links", DontDelete|ReadOnly, (intptr_t)jsDocumentLinks, (intptr_t)0 },
@@ -205,8 +208,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDocumentConstructor::s_info = { "DocumentConstructor", 0, &JSDocumentConstructorTable, 0 };
@@ -434,6 +440,14 @@ JSValue jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& s
     return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->body()));
 }
 
+JSValue jsDocumentHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->head()));
+}
+
 JSValue jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index 7cdbcbb..7b72b9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -58,6 +58,8 @@ public:
     {
         return static_cast<Document*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 ALWAYS_INLINE bool JSDocument::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
@@ -83,9 +85,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -152,6 +156,7 @@ JSC::JSValue jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC
 void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index f848040..19a132e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDocumentFragmentConstructor::s_info = { "DocumentFragmentConstructor", 0, &JSDocumentFragmentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index e532ca9..83120bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSDocumentFragmentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index 69e3fc6..3ca49dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSDocumentTypeConstructor::s_info = { "DocumentTypeConstructor", 0, &JSDocumentTypeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index c80a701..72da9be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -48,6 +48,8 @@ public:
     {
         return static_cast<DocumentType*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 DocumentType* toDocumentType(JSC::JSValue);
@@ -58,7 +60,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSDocumentTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 3844cb7..869c23f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -153,8 +153,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSElementConstructor::s_info = { "ElementConstructor", 0, &JSElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 39998c0..141d115 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
     {
         return static_cast<Element*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 ALWAYS_INLINE bool JSElement::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
@@ -84,9 +86,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 20d9cba..6f870e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEntityConstructor::s_info = { "EntityConstructor", 0, &JSEntityConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 3f79f68..6ea4fe5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSEntityPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index e33b91f..505374a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -73,8 +73,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEntityReferenceConstructor::s_info = { "EntityReferenceConstructor", 0, &JSEntityReferenceConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index 5d05523..bec01e6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSEntityReferencePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
index d1cad0b..ef9a080 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSErrorEventConstructor::s_info = { "ErrorEventConstructor", 0, &JSErrorEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
index 9046f11..080b573 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSErrorEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index a7a0894..acd952f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -109,8 +109,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEventConstructor::s_info = { "EventConstructor", 0, &JSEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index d338302..0249fe1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<Event> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Event*);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index 326e792..2246c8f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSEventExceptionConstructor::s_info = { "EventExceptionConstructor", 0, &JSEventExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index 093aa6a..694cbad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<EventException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, EventException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSEventExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
index dbaa492..4d5803b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
 
 private:
     RefPtr<EventSource> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, EventSource*);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSEventSourcePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 962f1f5e..2ee62ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSFileConstructor::s_info = { "FileConstructor", 0, &JSFileConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h
index d47f286..3a5ed41 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<File> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, File*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSFilePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index 228615a..931aae4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSFileListConstructor::s_info = { "FileListConstructor", 0, &JSFileListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.h b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
index 21bed99..495f47a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<FileList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSFileListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
index 6b3453b..e948667 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<Geolocation> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Geolocation*);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSGeolocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
index 7406bb2..a58a41e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     Geoposition* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Geoposition> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Geoposition*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSGeopositionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
index 2b59fd0..3ba8201 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAnchorElementConstructor::s_info = { "HTMLAnchorElementConstructor", 0, &JSHTMLAnchorElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
index 6bfc3d6..db460ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLAnchorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
index c822a44..df39815 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAppletElementConstructor::s_info = { "HTMLAppletElementConstructor", 0, &JSHTMLAppletElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
index 5390216..68eee1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
@@ -44,12 +44,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLAppletElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLAppletElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
index c5fc1d6..50ca880 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAreaElementConstructor::s_info = { "HTMLAreaElementConstructor", 0, &JSHTMLAreaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
index 6d9cb85..e2edf7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLAreaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
index d537dd8..991a0b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLAudioElementConstructor::s_info = { "HTMLAudioElementConstructor", 0, &JSHTMLAudioElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
index 2710178..b8cd9ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLAudioElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
index a806ac1..23e43af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBRElementConstructor::s_info = { "HTMLBRElementConstructor", 0, &JSHTMLBRElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
index 71069f1..6e6a691 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
index 125f8f8..fe57b25 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBaseElementConstructor::s_info = { "HTMLBaseElementConstructor", 0, &JSHTMLBaseElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
index 9af935a..6e86fb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBaseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
index 507e7c3..806680f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBaseFontElementConstructor::s_info = { "HTMLBaseFontElementConstructor", 0, &JSHTMLBaseFontElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
index c1da140..02a5ece 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBaseFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
index 1d33ea3..1d65349 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBlockquoteElementConstructor::s_info = { "HTMLBlockquoteElementConstructor", 0, &JSHTMLBlockquoteElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
index 0ac17ba..acead7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBlockquoteElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index 80db063..920f152 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -94,8 +94,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLBodyElementConstructor::s_info = { "HTMLBodyElementConstructor", 0, &JSHTMLBodyElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
index 8ce19c0..8f4e940 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLBodyElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
index 3f9655e..1874cb7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLButtonElementConstructor::s_info = { "HTMLButtonElementConstructor", 0, &JSHTMLButtonElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
index 21c3e80..3b8204b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLButtonElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
index ce41e88..5c7e058 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLCanvasElementConstructor::s_info = { "HTMLCanvasElementConstructor", 0, &JSHTMLCanvasElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
index b0dedfe..012b6df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
@@ -40,12 +40,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLCanvasElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index a4644e2..63c0d93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLCollectionConstructor::s_info = { "HTMLCollectionConstructor", 0, &JSHTMLCollectionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index edffe1d..447f620 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -60,6 +60,8 @@ public:
 
 private:
     RefPtr<HTMLCollection> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLCollection*, const JSC::Identifier&);
@@ -79,9 +81,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
index ab9f86d..bd1f703 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDListElementConstructor::s_info = { "HTMLDListElementConstructor", 0, &JSHTMLDListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
index 852fe01..4d602c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
index 7654d1a..089228d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridCellElementConstructor::s_info = { "HTMLDataGridCellElementConstructor", 0, &JSHTMLDataGridCellElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
index 7b778bd..5bdeff2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridCellElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
index b39dddf..9a85c51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridColElementConstructor::s_info = { "HTMLDataGridColElementConstructor", 0, &JSHTMLDataGridColElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
index 3e09036..473a1fc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridColElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
index 8400732..217df53 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridElementConstructor::s_info = { "HTMLDataGridElementConstructor", 0, &JSHTMLDataGridElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
index e466ebd..eedca14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -50,6 +50,8 @@ public:
     // Custom attributes
     JSC::JSValue dataSource(JSC::ExecState*) const;
     void setDataSource(JSC::ExecState*, JSC::JSValue);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
index 2225c98..c9ca326 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataGridRowElementConstructor::s_info = { "HTMLDataGridRowElementConstructor", 0, &JSHTMLDataGridRowElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
index 749cf0c..2316318 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataGridRowElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
index a7dcd91..4f88a2b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDataListElementConstructor::s_info = { "HTMLDataListElementConstructor", 0, &JSHTMLDataListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
index 32d34bc..79c6274 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDataListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
index 838dc83..6c1a334 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDirectoryElementConstructor::s_info = { "HTMLDirectoryElementConstructor", 0, &JSHTMLDirectoryElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
index a0c1aa1..71661a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDirectoryElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
index 5fa429c..78da25f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDivElementConstructor::s_info = { "HTMLDivElementConstructor", 0, &JSHTMLDivElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
index 7751ffe..7806e45 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLDivElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
index 5e1cd6c..e45c9ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
@@ -97,8 +97,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLDocumentConstructor::s_info = { "HTMLDocumentConstructor", 0, &JSHTMLDocumentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
index f19fb41..feb5b88 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
     JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue write(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue writeln(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLDocument*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
index dc08b3d..86d32d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLElementConstructor::s_info = { "HTMLElementConstructor", 0, &JSHTMLElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
index aef78d2..6928db7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
@@ -51,6 +51,8 @@ public:
     {
         return static_cast<HTMLElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLElement* toHTMLElement(JSC::JSValue);
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
index d4333cc..1d43b5e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
@@ -88,8 +88,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLEmbedElementConstructor::s_info = { "HTMLEmbedElementConstructor", 0, &JSHTMLEmbedElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
index 8a1d7bb..e7c27cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
@@ -44,12 +44,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLEmbedElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLEmbedElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
index 2bec961..d161eae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFieldSetElementConstructor::s_info = { "HTMLFieldSetElementConstructor", 0, &JSHTMLFieldSetElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
index 38edfb2..f23e5fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLFieldSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
index 794640f..720a0b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFontElementConstructor::s_info = { "HTMLFontElementConstructor", 0, &JSHTMLFontElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
index 61a0b78..cb4670c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
index bdd60b8..bd11b40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
@@ -91,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFormElementConstructor::s_info = { "HTMLFormElementConstructor", 0, &JSHTMLFormElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
index a28742e..b022fd6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -48,6 +48,8 @@ public:
 
     // Custom functions
     JSC::JSValue submit(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFormElement*, const JSC::Identifier&);
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLFormElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
index 03a071e..4ddb621 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
@@ -98,8 +98,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFrameElementConstructor::s_info = { "HTMLFrameElementConstructor", 0, &JSHTMLFrameElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
index fe0b2fa..7894c4f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -48,6 +48,8 @@ public:
     // Custom attributes
     void setSrc(JSC::ExecState*, JSC::JSValue);
     void setLocation(JSC::ExecState*, JSC::JSValue);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -61,9 +63,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLFrameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index 8c69079..f336c76 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLFrameSetElementConstructor::s_info = { "HTMLFrameSetElementConstructor", 0, &JSHTMLFrameSetElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
index e9aa3f9..216fa59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFrameSetElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -56,7 +58,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLFrameSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
index 72ac500..e58b90d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHRElementConstructor::s_info = { "HTMLHRElementConstructor", 0, &JSHTMLHRElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
index c69d61b..4472820 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
index 7bcb644..ab10942 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHeadElementConstructor::s_info = { "HTMLHeadElementConstructor", 0, &JSHTMLHeadElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
index c3b4d50..585eb60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHeadElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
index 7e0f680..5409279 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHeadingElementConstructor::s_info = { "HTMLHeadingElementConstructor", 0, &JSHTMLHeadingElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
index 512e05b..a33f6f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHeadingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
index 932a96c..f9c9b3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLHtmlElementConstructor::s_info = { "HTMLHtmlElementConstructor", 0, &JSHTMLHtmlElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
index a46605c..37b9bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLHtmlElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
index 3606652..ea1d18c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLIFrameElementConstructor::s_info = { "HTMLIFrameElementConstructor", 0, &JSHTMLIFrameElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
index 22ed276..6153f79 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
@@ -40,13 +40,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom attributes
     void setSrc(JSC::ExecState*, JSC::JSValue);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLIFrameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
index 029933c..7a6e0f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
@@ -95,8 +95,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLImageElementConstructor::s_info = { "HTMLImageElementConstructor", 0, &JSHTMLImageElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
index 2ec34dc..403a98b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
index ea6e7cb..5b65ab8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
@@ -43,7 +43,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLInputElementTableValues[31] =
+static const HashTableValue JSHTMLInputElementTableValues[33] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLInputElementDefaultValue, (intptr_t)setJSHTMLInputElementDefaultValue },
     { "defaultChecked", DontDelete, (intptr_t)jsHTMLInputElementDefaultChecked, (intptr_t)setJSHTMLInputElementDefaultChecked },
@@ -57,7 +57,9 @@ static const HashTableValue JSHTMLInputElementTableValues[31] =
     { "checked", DontDelete, (intptr_t)jsHTMLInputElementChecked, (intptr_t)setJSHTMLInputElementChecked },
     { "disabled", DontDelete, (intptr_t)jsHTMLInputElementDisabled, (intptr_t)setJSHTMLInputElementDisabled },
     { "autofocus", DontDelete, (intptr_t)jsHTMLInputElementAutofocus, (intptr_t)setJSHTMLInputElementAutofocus },
+    { "max", DontDelete, (intptr_t)jsHTMLInputElementMax, (intptr_t)setJSHTMLInputElementMax },
     { "maxLength", DontDelete, (intptr_t)jsHTMLInputElementMaxLength, (intptr_t)setJSHTMLInputElementMaxLength },
+    { "min", DontDelete, (intptr_t)jsHTMLInputElementMin, (intptr_t)setJSHTMLInputElementMin },
     { "multiple", DontDelete, (intptr_t)jsHTMLInputElementMultiple, (intptr_t)setJSHTMLInputElementMultiple },
     { "name", DontDelete, (intptr_t)jsHTMLInputElementName, (intptr_t)setJSHTMLInputElementName },
     { "pattern", DontDelete, (intptr_t)jsHTMLInputElementPattern, (intptr_t)setJSHTMLInputElementPattern },
@@ -82,7 +84,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLInputElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 2047, JSHTMLInputElementTableValues, 0 };
 #else
-    { 72, 63, JSHTMLInputElementTableValues, 0 };
+    { 73, 63, JSHTMLInputElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -113,8 +115,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLInputElementConstructor::s_info = { "HTMLInputElementConstructor", 0, &JSHTMLInputElementConstructorTable, 0 };
@@ -283,6 +288,14 @@ JSValue jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const Pr
     return jsBoolean(imp->autofocus());
 }
 
+JSValue jsHTMLInputElementMax(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    return jsString(exec, imp->getAttribute(HTMLNames::maxAttr));
+}
+
 JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
@@ -291,6 +304,14 @@ JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const Pr
     return jsNumber(exec, imp->maxLength());
 }
 
+JSValue jsHTMLInputElementMin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    return jsString(exec, imp->getAttribute(HTMLNames::minAttr));
+}
+
 JSValue jsHTMLInputElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
@@ -483,6 +504,12 @@ void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSVal
     imp->setAutofocus(value.toBoolean(exec));
 }
 
+void setJSHTMLInputElementMax(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setAttribute(HTMLNames::maxAttr, value.toString(exec));
+}
+
 void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
@@ -491,6 +518,12 @@ void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSVal
     setDOMException(exec, ec);
 }
 
+void setJSHTMLInputElementMin(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setAttribute(HTMLNames::minAttr, value.toString(exec));
+}
+
 void setJSHTMLInputElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
index e26b281..5ed72b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
     // Custom functions
     JSC::JSValue setSelectionRange(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLInputElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -103,8 +107,12 @@ JSC::JSValue jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&,
 void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMax(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMax(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
index 2ae43a7..41814f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLIsIndexElementConstructor::s_info = { "HTMLIsIndexElementConstructor", 0, &JSHTMLIsIndexElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
index 9ac79cb..8f21361 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLIsIndexElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
index f27b58e..2cc828c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLIElementConstructor::s_info = { "HTMLLIElementConstructor", 0, &JSHTMLLIElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
index 09d6ffb..948746c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLIElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
index 7409c70..214ed4f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLabelElementConstructor::s_info = { "HTMLLabelElementConstructor", 0, &JSHTMLLabelElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
index 1991301..3577f5f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLabelElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
index 5efaebb..000b301 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLegendElementConstructor::s_info = { "HTMLLegendElementConstructor", 0, &JSHTMLLegendElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
index c766306..420e05d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLegendElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
index 5692047..3283d26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
@@ -87,8 +87,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLLinkElementConstructor::s_info = { "HTMLLinkElementConstructor", 0, &JSHTMLLinkElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
index 5d46062..5ea2147 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLLinkElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
index e3e9ef1..d4fc27d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMapElementConstructor::s_info = { "HTMLMapElementConstructor", 0, &JSHTMLMapElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
index f17deae..2312094 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLMapElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
index a5e3697..9db661a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMarqueeElementConstructor::s_info = { "HTMLMarqueeElementConstructor", 0, &JSHTMLMarqueeElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
index 64d552f..de9770a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLMarqueeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
index 8fc5aa6..f3f3a8d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
@@ -117,8 +117,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMediaElementConstructor::s_info = { "HTMLMediaElementConstructor", 0, &JSHTMLMediaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
index 2eee952..66ea4cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLMediaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
index d6439e0..67daa6e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
@@ -74,8 +74,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMenuElementConstructor::s_info = { "HTMLMenuElementConstructor", 0, &JSHTMLMenuElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
index 88c816d..d778342 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLMenuElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
index 494076c..b32b1d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLMetaElementConstructor::s_info = { "HTMLMetaElementConstructor", 0, &JSHTMLMetaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
index 2bb93a3..4ff2b8e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLMetaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
index 259618f..d440576 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLModElementConstructor::s_info = { "HTMLModElementConstructor", 0, &JSHTMLModElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
index 6f920e4..a2aed45 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLModElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
index 1bf8256..105c49e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLOListElementConstructor::s_info = { "HTMLOListElementConstructor", 0, &JSHTMLOListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
index a2d095e..9ecb940 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLOListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
index 57f2fa6..7203ff1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
@@ -106,8 +106,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLObjectElementConstructor::s_info = { "HTMLObjectElementConstructor", 0, &JSHTMLObjectElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
index d4ad484..4dd52ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
@@ -44,12 +44,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLObjectElement*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLObjectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
index 2772290..340f910 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLOptGroupElementConstructor::s_info = { "HTMLOptGroupElementConstructor", 0, &JSHTMLOptGroupElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
index a7cd4d9..1d57815 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLOptGroupElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
index 4b32c87..b10d41c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLOptionElementConstructor::s_info = { "HTMLOptionElementConstructor", 0, &JSHTMLOptionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
index 232be18..44a2d3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
     {
         return static_cast<HTMLOptionElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLOptionElement* toHTMLOptionElement(JSC::JSValue);
@@ -59,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLOptionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
index 800b0a8..034fa1b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -57,6 +57,8 @@ public:
     {
         return static_cast<HTMLOptionsCollection*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLOptionsCollectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
index a065d16..098d111 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLParagraphElementConstructor::s_info = { "HTMLParagraphElementConstructor", 0, &JSHTMLParagraphElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
index f7b5e37..fc15b12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLParagraphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
index bec35a7..51eb728 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLParamElementConstructor::s_info = { "HTMLParamElementConstructor", 0, &JSHTMLParamElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
index 1dde72d..be8f7b8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLParamElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
index 4d5fb9c..d06b203 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLPreElementConstructor::s_info = { "HTMLPreElementConstructor", 0, &JSHTMLPreElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
index 92c86fa..ef78b72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLPreElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
index 1864245..c1b9957 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLQuoteElementConstructor::s_info = { "HTMLQuoteElementConstructor", 0, &JSHTMLQuoteElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
index 03edf4e..f0f1248 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLQuoteElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
index 5867c87..4e39698 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLScriptElementConstructor::s_info = { "HTMLScriptElementConstructor", 0, &JSHTMLScriptElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
index 9cb3874..93f4dba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLScriptElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
index 1edfb8c..5feda47 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLSelectElementConstructor::s_info = { "HTMLSelectElementConstructor", 0, &JSHTMLSelectElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
index 12141cd..32066cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -50,6 +50,8 @@ public:
 
     // Custom functions
     JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
@@ -65,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLSelectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
index f6ce114..377c409 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLSourceElementConstructor::s_info = { "HTMLSourceElementConstructor", 0, &JSHTMLSourceElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
index d33d1a2..f66761e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLSourceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
index 7fb2ddb..5137a97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLStyleElementConstructor::s_info = { "HTMLStyleElementConstructor", 0, &JSHTMLStyleElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
index efa49f6..c05261c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLStyleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
index 1668c03..4b81e96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableCaptionElementConstructor::s_info = { "HTMLTableCaptionElementConstructor", 0, &JSHTMLTableCaptionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
index fa4f77d..4dafac5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
     {
         return static_cast<HTMLTableCaptionElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue);
@@ -59,7 +61,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTableCaptionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
index 2d3c63c..5ff1e49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
@@ -91,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableCellElementConstructor::s_info = { "HTMLTableCellElementConstructor", 0, &JSHTMLTableCellElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
index d5f5ad0..baa70fc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTableCellElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
index e3bcbef..8bfb70a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableColElementConstructor::s_info = { "HTMLTableColElementConstructor", 0, &JSHTMLTableColElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
index 95aebe4..f761d51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTableColElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
index 70f45a2..1cafa00 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
@@ -98,8 +98,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableElementConstructor::s_info = { "HTMLTableElementConstructor", 0, &JSHTMLTableElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
index 08ef645..9bc9dc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTableElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
index 29dbcf6..6dd1622 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableRowElementConstructor::s_info = { "HTMLTableRowElementConstructor", 0, &JSHTMLTableRowElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
index 3adbb01..a997475 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTableRowElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
index ad10c49..b00b883 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTableSectionElementConstructor::s_info = { "HTMLTableSectionElementConstructor", 0, &JSHTMLTableSectionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
index 85c54c1..6760be5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
     {
         return static_cast<HTMLTableSectionElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue);
@@ -63,9 +65,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTableSectionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index 8d43a63..fdd60b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTextAreaElementConstructor::s_info = { "HTMLTextAreaElementConstructor", 0, &JSHTMLTextAreaElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index 3b28ae9..3b36f3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHTMLTextAreaElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
index 51bffa4..fe642d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLTitleElementConstructor::s_info = { "HTMLTitleElementConstructor", 0, &JSHTMLTitleElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
index 8f88dac..8cc7eca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLTitleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
index 5a541b4..58bc209 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLUListElementConstructor::s_info = { "HTMLUListElementConstructor", 0, &JSHTMLUListElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
index 9f7f717..d65d7cb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLUListElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
index 4331798..b8f2da3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSHTMLVideoElementConstructor::s_info = { "HTMLVideoElementConstructor", 0, &JSHTMLVideoElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
index e74590f..7a60109 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSHTMLVideoElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.h b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
index 9ea7e91..a08fc19 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<History> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, History*);
@@ -71,9 +73,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSHistoryPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index 973ec26..a21fb87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSImageDataConstructor::s_info = { "ImageDataConstructor", 0, &JSImageDataConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.h b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
index d84357c..0c42e5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<ImageData> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ImageData*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSImageDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index f770cf2..8da82cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSInspectorBackendConstructor::s_info = { "InspectorBackendConstructor", 0, &JSInspectorBackendConstructorTable, 0 };
@@ -96,7 +99,7 @@ bool JSInspectorBackendConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSInspectorBackendPrototypeTableValues[71] =
+static const HashTableValue JSInspectorBackendPrototypeTableValues[77] =
 {
     { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
     { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
@@ -112,16 +115,16 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[71] =
     { "addResourceSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame, (intptr_t)2 },
     { "addSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddSourceToFrame, (intptr_t)3 },
     { "search", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSearch, (intptr_t)2 },
-    { "databaseTableNames", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDatabaseTableNames, (intptr_t)1 },
+    { "getDatabaseTableNames", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDatabaseTableNames, (intptr_t)2 },
     { "setting", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetting, (intptr_t)1 },
     { "setSetting", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetSetting, (intptr_t)2 },
     { "inspectedWindow", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionInspectedWindow, (intptr_t)0 },
     { "localizedStringsURL", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionLocalizedStringsURL, (intptr_t)0 },
     { "hiddenPanels", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHiddenPanels, (intptr_t)0 },
     { "platform", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPlatform, (intptr_t)0 },
-    { "enableTimeline", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableTimeline, (intptr_t)1 },
-    { "disableTimeline", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableTimeline, (intptr_t)1 },
-    { "timelineEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionTimelineEnabled, (intptr_t)0 },
+    { "startTimelineProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartTimelineProfiler, (intptr_t)0 },
+    { "stopTimelineProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopTimelineProfiler, (intptr_t)0 },
+    { "timelineProfilerEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled, (intptr_t)0 },
     { "moveByUnrestricted", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionMoveByUnrestricted, (intptr_t)2 },
     { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight, (intptr_t)1 },
     { "wrapCallback", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapCallback, (intptr_t)1 },
@@ -148,26 +151,32 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[71] =
     { "disableProfiler", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableProfiler, (intptr_t)1 },
     { "startProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartProfiling, (intptr_t)0 },
     { "stopProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopProfiling, (intptr_t)0 },
-    { "profiles", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionProfiles, (intptr_t)0 },
-    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript, (intptr_t)3 },
+    { "getProfileHeaders", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetProfileHeaders, (intptr_t)1 },
+    { "getProfile", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetProfile, (intptr_t)2 },
+    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript, (intptr_t)4 },
     { "getChildNodes", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetChildNodes, (intptr_t)2 },
     { "setAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttribute, (intptr_t)4 },
     { "removeAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveAttribute, (intptr_t)3 },
     { "setTextNodeValue", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetTextNodeValue, (intptr_t)3 },
     { "getEventListenersForNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetEventListenersForNode, (intptr_t)2 },
     { "copyNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCopyNode, (intptr_t)1 },
-    { "getCookies", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetCookies, (intptr_t)1 },
-    { "deleteCookie", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDeleteCookie, (intptr_t)1 },
+    { "removeNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveNode, (intptr_t)2 },
+    { "getCookies", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetCookies, (intptr_t)2 },
+    { "deleteCookie", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDeleteCookie, (intptr_t)2 },
     { "nodeForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionNodeForId, (intptr_t)1 },
-    { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)1 },
+    { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)2 },
     { "unwrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUnwrapObject, (intptr_t)1 },
+    { "releaseWrapperObjectGroup", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup, (intptr_t)1 },
     { "pushNodePathToFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPushNodePathToFrontend, (intptr_t)2 },
     { "addNodesToSearchResult", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddNodesToSearchResult, (intptr_t)1 },
     { "selectDatabase", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDatabase, (intptr_t)1 },
+    { "databaseForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDatabaseForId, (intptr_t)1 },
     { "selectDOMStorage", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDOMStorage, (intptr_t)1 },
     { "getDOMStorageEntries", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetDOMStorageEntries, (intptr_t)2 },
     { "setDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetDOMStorageItem, (intptr_t)4 },
     { "removeDOMStorageItem", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem, (intptr_t)3 },
+    { "reportDidDispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript, (intptr_t)3 },
+    { "didEvaluateForTestInFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend, (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -175,7 +184,7 @@ static JSC_CONST_HASHTABLE HashTable JSInspectorBackendPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 4095, JSInspectorBackendPrototypeTableValues, 0 };
 #else
-    { 262, 255, JSInspectorBackendPrototypeTableValues, 0 };
+    { 267, 255, JSInspectorBackendPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSInspectorBackendPrototype::s_info = { "InspectorBackendPrototype", 0, &JSInspectorBackendPrototypeTable, 0 };
@@ -404,13 +413,18 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(ExecState* exec,
     return castedThisObj->search(exec, args);
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->databaseTableNames(exec, args);
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int databaseId = args.at(1).toInt32(exec);
+
+    imp->getDatabaseTableNames(callId, databaseId);
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -479,33 +493,31 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(ExecState* exe
     return result;
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
 
-    imp->enableTimeline(always);
+    imp->startTimelineProfiler();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
-    bool always = args.at(0).toBoolean(exec);
 
-    imp->disableTimeline(always);
+    imp->stopTimelineProfiler();
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
@@ -514,7 +526,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(ExecSta
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
 
 
-    JSC::JSValue result = jsBoolean(imp->timelineEnabled());
+    JSC::JSValue result = jsBoolean(imp->timelineProfilerEnabled());
     return result;
 }
 
@@ -847,13 +859,31 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState
     return jsUndefined();
 }
 
-JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfiles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+
+    imp->getProfileHeaders(callId);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
     if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
-    return castedThisObj->profiles(exec, args);
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    unsigned uid = args.at(1).toInt32(exec);
+
+    imp->getProfile(callId, uid);
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -866,8 +896,9 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScrip
     int callId = args.at(0).toInt32(exec);
     const UString& methodName = args.at(1).toString(exec);
     const UString& arguments = args.at(2).toString(exec);
+    bool async = args.at(3).toBoolean(exec);
 
-    imp->dispatchOnInjectedScript(callId, methodName, arguments);
+    imp->dispatchOnInjectedScript(callId, methodName, arguments, async);
     return jsUndefined();
 }
 
@@ -958,6 +989,20 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(ExecState* exe
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
+
+    imp->removeNode(callId, nodeId);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -966,8 +1011,9 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(ExecState* e
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     int callId = args.at(0).toInt32(exec);
+    const UString& domain = args.at(1).toString(exec);
 
-    imp->getCookies(callId);
+    imp->getCookies(callId, domain);
     return jsUndefined();
 }
 
@@ -979,8 +1025,9 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(ExecState*
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     const UString& cookieName = args.at(0).toString(exec);
+    const UString& domain = args.at(1).toString(exec);
 
-    imp->deleteCookie(cookieName);
+    imp->deleteCookie(cookieName, domain);
     return jsUndefined();
 }
 
@@ -1011,6 +1058,19 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(ExecState*
     return castedThisObj->unwrapObject(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& objectGroup = args.at(0).toString(exec);
+
+    imp->releaseWrapperObjectGroup(objectGroup);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -1042,6 +1102,15 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(ExecStat
     return castedThisObj->selectDatabase(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->databaseForId(exec, args);
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -1096,6 +1165,35 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(Ex
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    const UString& result = args.at(1).toString(exec);
+    bool isException = args.at(2).toBoolean(exec);
+
+    imp->reportDidDispatchOnInjectedScript(callId, result, isException);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    const UString& jsonResult = args.at(1).toString(exec);
+
+    imp->didEvaluateForTestInFrontend(callId, jsonResult);
+    return jsUndefined();
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InspectorBackend* object)
 {
     return getDOMObjectWrapper<JSInspectorBackend>(exec, globalObject, object);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
index 5e2239f..f4a1925 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,23 +51,24 @@ public:
     // Custom functions
     JSC::JSValue highlightDOMNode(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue search(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue databaseTableNames(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setting(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setSetting(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue inspectedWindow(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue wrapCallback(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue profiles(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue nodeForId(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue wrapObject(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue unwrapObject(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue pushNodePathToFrontend(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue selectDatabase(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue databaseForId(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue selectDOMStorage(JSC::ExecState*, const JSC::ArgList&);
     InspectorBackend* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<InspectorBackend> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, InspectorBackend*);
@@ -83,9 +84,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSInspectorBackendPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -104,16 +107,16 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(J
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopTimelineProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineProfilerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -140,7 +143,8 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(JSC
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfiles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfileHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -148,18 +152,23 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(JS
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetEventListenersForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReleaseWrapperObjectGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetDOMStorageEntries(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveDOMStorageItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionReportDidDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDidEvaluateForTestInFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsInspectorBackendConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
index c958ee0..a209147 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -60,6 +60,8 @@ public:
 
 private:
     RefPtr<JavaScriptCallFrame> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JavaScriptCallFrame*);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSJavaScriptCallFramePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
index 90d964d..4beaa59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSKeyboardEventConstructor::s_info = { "KeyboardEventConstructor", 0, &JSKeyboardEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
index c1567b8..7d60933 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSKeyboardEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index ecdeffc..2948ce6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
@@ -73,6 +73,8 @@ public:
 
 private:
     RefPtr<Location> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Location*);
@@ -88,12 +90,14 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
     JSLocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
index 6f18ed0..b7d4c19 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMediaConstructor::s_info = { "MediaConstructor", 0, &JSMediaConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.h b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
index 5a08af2..fec492b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMedia.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Media> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Media*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMediaPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index a1bc33e..97e35e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMediaErrorConstructor::s_info = { "MediaErrorConstructor", 0, &JSMediaErrorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
index 9dfecd3..847dd0e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<MediaError> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MediaError*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMediaErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index 1167ae5..93a17b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMediaListConstructor::s_info = { "MediaListConstructor", 0, &JSMediaListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
index a37501d..30853df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<MediaList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMediaListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
index 63503fc..8b8b127 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<MessageChannel> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MessageChannel*);
@@ -65,9 +67,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMessageChannelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
index 2867a17..f308150 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
@@ -25,6 +25,7 @@
 #include "JSDOMWindow.h"
 #include "KURL.h"
 #include "MessageEvent.h"
+#include "SerializedScriptValue.h"
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
@@ -83,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMessageEventConstructor::s_info = { "MessageEventConstructor", 0, &JSMessageEventConstructorTable, 0 };
@@ -166,7 +170,7 @@ JSValue jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlo
     JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return jsString(exec, imp->data());
+    return imp->data()->deserialize(exec);
 }
 
 JSValue jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
index 1cb3562..d109987 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -49,6 +49,8 @@ public:
 
     // Custom functions
     JSC::JSValue initMessageEvent(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -62,9 +64,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMessageEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index 2f84364..28e1492 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -83,8 +83,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMessagePortConstructor::s_info = { "MessagePortConstructor", 0, &JSMessagePortConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
index 6c6e94e..6d3aa61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -59,6 +59,8 @@ public:
 
 private:
     RefPtr<MessagePort> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MessagePort*);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMessagePortPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index 1f97845..f797df2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMimeTypeConstructor::s_info = { "MimeTypeConstructor", 0, &JSMimeTypeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
index 9c4d1e3..e3ee635 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<MimeType> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, MimeType*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSMimeTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 1a7f06b..0384539 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMimeTypeArrayConstructor::s_info = { "MimeTypeArrayConstructor", 0, &JSMimeTypeArrayConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
index 1fe01bb..87b7438 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<MimeTypeArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, MimeTypeArray*, const JSC::Identifier&);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMimeTypeArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
index 9b2220b..47c4b14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
@@ -99,8 +99,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMouseEventConstructor::s_info = { "MouseEventConstructor", 0, &JSMouseEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
index b13d5e6..c7a6e9e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMouseEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
index cb47db7..6565d40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
@@ -87,8 +87,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSMutationEventConstructor::s_info = { "MutationEventConstructor", 0, &JSMutationEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
index 4a06315..2fbd82b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSMutationEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index eafaee1..e3cc8d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNamedNodeMapConstructor::s_info = { "NamedNodeMapConstructor", 0, &JSNamedNodeMapConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index 6ea0e2f..305877b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<NamedNodeMap> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NamedNodeMap*, const JSC::Identifier&);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNamedNodeMapPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
index ec14055..5847e96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -52,6 +52,8 @@ public:
 
 private:
     RefPtr<Navigator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Navigator*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNavigatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index 8ae675c..e132829 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -124,8 +124,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeConstructor::s_info = { "NodeConstructor", 0, &JSNodeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index 2275f39..0398122 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -66,6 +66,8 @@ public:
 
 private:
     RefPtr<Node> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 ALWAYS_INLINE bool JSNode::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
@@ -92,9 +94,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index c50caf8..141a060 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -90,8 +90,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeFilterConstructor::s_info = { "NodeFilterConstructor", 0, &JSNodeFilterConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
index 48eb6b4..c59011a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<NodeFilter> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, NodeFilter*);
@@ -71,9 +73,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodeFilterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 89ea643..cf85e40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeIteratorConstructor::s_info = { "NodeIteratorConstructor", 0, &JSNodeIteratorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
index 21902e5..64bf10f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<NodeIterator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, NodeIterator*);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodeIteratorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index be3bf91..01ee9ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNodeListConstructor::s_info = { "NodeListConstructor", 0, &JSNodeListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
index 82e1cb6..76840f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -56,6 +56,8 @@ public:
 
 private:
     RefPtr<NodeList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NodeList*, const JSC::Identifier&);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSNodeListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
index 60a04fa..bf91e7c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSNotationConstructor::s_info = { "NotationConstructor", 0, &JSNotationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.h b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
index 71fd2d8..79656a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSNotationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
index 26bd08e..fdc3a64 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
@@ -81,8 +81,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSOverflowEventConstructor::s_info = { "OverflowEventConstructor", 0, &JSOverflowEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
index 8e2fb7f..e9e10d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSOverflowEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
index 254d0e9..55d5a54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
@@ -75,8 +75,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPageTransitionEventConstructor::s_info = { "PageTransitionEventConstructor", 0, &JSPageTransitionEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
index 5829b8d..6e38558 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPageTransitionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index 1c4b9a6..035a352 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPluginConstructor::s_info = { "PluginConstructor", 0, &JSPluginConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
index 98de1de..03da3df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<Plugin> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, Plugin*, const JSC::Identifier&);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPluginPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 0e8eec0..bd0b579 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPluginArrayConstructor::s_info = { "PluginArrayConstructor", 0, &JSPluginArrayConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
index 859aefb..9c2e6ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<PluginArray> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, PluginArray*, const JSC::Identifier&);
@@ -72,9 +74,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPluginArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index 557c029..e178bd9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSPositionErrorConstructor::s_info = { "PositionErrorConstructor", 0, &JSPositionErrorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
index 7e680ae..01ba3e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<PositionError> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, PositionError*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSPositionErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
index 267a269..8c8de3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSProcessingInstructionConstructor::s_info = { "ProcessingInstructionConstructor", 0, &JSProcessingInstructionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
index 6780d2e..b3c239b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSProcessingInstructionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
index 3b1caaa..c74e80d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSProgressEventConstructor::s_info = { "ProgressEventConstructor", 0, &JSProgressEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
index c2c4877..34e1985 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSProgressEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
index 5144543..0dff99a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRGBColorConstructor::s_info = { "RGBColorConstructor", 0, &JSRGBColorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
index d1425e4..2e6c715 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<RGBColor> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, RGBColor*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSRGBColorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index d6d4d93..cc59119 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -100,8 +100,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRangeConstructor::s_info = { "RangeConstructor", 0, &JSRangeConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index b58a4bf..8b45a3f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Range> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Range*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSRangePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index 5a975cc..2f8e618 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRangeExceptionConstructor::s_info = { "RangeExceptionConstructor", 0, &JSRangeExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
index 162acb8..1a9e2ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<RangeException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, RangeException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSRangeExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index 84d20e4..37c4669 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSRectConstructor::s_info = { "RectConstructor", 0, &JSRectConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.h b/src/3rdparty/webkit/WebCore/generated/JSRect.h
index cefef58..476a5a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<Rect> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Rect*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
index 9174130..5368452 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SQLError* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLError> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLError*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSQLErrorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
index f463380..b1551f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SQLResultSet* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLResultSet> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLResultSet*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSQLResultSetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
index 83df584..67b8fd2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<SQLResultSetRowList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLResultSetRowList*);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSQLResultSetRowListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
index a3886d3..7438597 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
@@ -41,6 +41,11 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
 
     // Custom functions
     JSC::JSValue executeSql(JSC::ExecState*, const JSC::ArgList&);
@@ -48,6 +53,8 @@ public:
 
 private:
     RefPtr<SQLTransaction> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SQLTransaction*);
@@ -63,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSQLTransactionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
index f7d3cf9..f54337b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGAElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
index ac03bb4..050f980 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAltGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index 6c82779..220f4a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGAngleConstructor::s_info = { "SVGAngleConstructor", 0, &JSSVGAngleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
index 2630c3d..42fdbbd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<SVGAngle> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAngle*, SVGElement* context);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGAnglePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
index 48cf5f7..52ab586 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimateColorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
index e94048a..0ffe6de 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimateElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
index 0628bee..3a99234 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimateTransformElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
index 8b1be0b..c822dc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedAngle* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedAngle> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedAngle*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedAnglePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
index 14f3208..c6690a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedBoolean* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedBoolean> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedBoolean*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedBooleanPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
index b2a40c2..6f036d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedEnumeration* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedEnumeration> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedEnumeration*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedEnumerationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
index 4484335..113f0b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedInteger* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedInteger> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedInteger*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedIntegerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
index 7016f60..671eed8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedLength* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedLength> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedLength*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedLengthPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
index e95fb92..aa32b12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedLengthList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedLengthList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedLengthList*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedLengthListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
index e33b50d..4c49a92 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedNumber* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedNumber> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedNumber*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedNumberPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
index 3729b0a..4b61561 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedNumberList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedNumberList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedNumberList*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedNumberListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
index 5a1feb6..eca4cb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedPreserveAspectRatio* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedPreserveAspectRatio> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedPreserveAspectRatio*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedPreserveAspectRatioPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
index 7f9e25d..904a78c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedRect* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedRect> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedRect*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
index b7d35e1..216e643 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedString* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedString> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedString*, SVGElement* context);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedStringPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
index 9917280..3c7b0a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGAnimatedTransformList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGAnimatedTransformList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGAnimatedTransformList*, SVGElement* context);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGAnimatedTransformListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
index f0d421d..e36dc3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGAnimationElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
index 8c609b5..0633d2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGCircleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
index 2dcb7f2..8818254 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGClipPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
index d60e65d..7a89671 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGColorConstructor::s_info = { "SVGColorConstructor", 0, &JSSVGColorConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
index 03f5c31..220f73e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGColorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
index e37e52e..f346d07 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
@@ -92,8 +92,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGComponentTransferFunctionElementConstructor::s_info = { "SVGComponentTransferFunctionElementConstructor", 0, &JSSVGComponentTransferFunctionElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
index bda4119..b7cf7c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGComponentTransferFunctionElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
index 137803a..ef61751 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGCursorElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
index 522d278..da6470b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGDefsElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
index 920127b..1f43e7a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGDescElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
index 830952b..47c6b15 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
index 2278043..c4cc3a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
@@ -24,6 +24,7 @@
 
 #include "JSSVGElement.h"
 
+#include "HTMLNames.h"
 #include "JSSVGElement.h"
 #include "JSSVGSVGElement.h"
 #include "KURL.h"
@@ -104,7 +105,7 @@ JSValue jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& s
     JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(castedThis->impl());
-    return jsString(exec, imp->id());
+    return jsString(exec, imp->getAttribute(HTMLNames::idAttr));
 }
 
 JSValue jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -140,7 +141,7 @@ void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setId(valueToStringWithNullCheck(exec, value), ec);
+    imp->setAttribute(HTMLNames::idAttr, valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
index 39b1660..111f9b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGElement* impl() const
     {
         return static_cast<SVGElement*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 SVGElement* toSVGElement(JSC::JSValue);
@@ -60,7 +62,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
index 2ed2f72..57a150f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGElementInstance> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGElementInstance*);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGElementInstancePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
index bfbebed..257f405 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGElementInstanceList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGElementInstanceList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGElementInstanceList*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGElementInstanceListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
index 477b037..100dfa1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGEllipseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index 0b41188..039182f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGExceptionConstructor::s_info = { "SVGExceptionConstructor", 0, &JSSVGExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
index 646f003..21f4221 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGException*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
index e7aebf9..d32f276 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEBlendElementConstructor::s_info = { "SVGFEBlendElementConstructor", 0, &JSSVGFEBlendElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
index 41cc90a..910f9b8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEBlendElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
index 34252d9..0f1d439 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEColorMatrixElementConstructor::s_info = { "SVGFEColorMatrixElementConstructor", 0, &JSSVGFEColorMatrixElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
index 65b8b2a..5c9305e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEColorMatrixElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
index 71ca39c..265d70c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEComponentTransferElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
index 782be78..c0de8f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
@@ -49,7 +49,7 @@ static const HashTableValue JSSVGFECompositeElementTableValues[16] =
 {
     { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementIn1, (intptr_t)0 },
     { "in2", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementIn2, (intptr_t)0 },
-    { "_operator", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElement_operator, (intptr_t)0 },
+    { "operator", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementOperator, (intptr_t)0 },
     { "k1", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK1, (intptr_t)0 },
     { "k2", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK2, (intptr_t)0 },
     { "k3", DontDelete|ReadOnly, (intptr_t)jsSVGFECompositeElementK3, (intptr_t)0 },
@@ -107,8 +107,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFECompositeElementConstructor::s_info = { "SVGFECompositeElementConstructor", 0, &JSSVGFECompositeElementConstructorTable, 0 };
@@ -202,7 +205,7 @@ JSValue jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const Pro
     return toJS(exec, castedThis->globalObject(), obj.get(), imp);
 }
 
-JSValue jsSVGFECompositeElement_operator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementOperator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
index ef165b9..70cb296 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFECompositeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -71,7 +75,7 @@ JSC::JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentati
 
 JSC::JSValue jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsSVGFECompositeElement_operator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementOperator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
index 87eac3d..442cb71 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEDiffuseLightingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
index c5f7fbb..6bdd56e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
@@ -103,8 +103,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEDisplacementMapElementConstructor::s_info = { "SVGFEDisplacementMapElementConstructor", 0, &JSSVGFEDisplacementMapElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
index 39098b8..d5eafce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEDisplacementMapElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
index 810f1cd..becbe95 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEDistantLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
index 2c331e3..3ee186c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
@@ -43,9 +43,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEFloodElementTableValues[10] =
+static const HashTableValue JSSVGFEFloodElementTableValues[9] =
 {
-    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementIn1, (intptr_t)0 },
     { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementX, (intptr_t)0 },
     { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementY, (intptr_t)0 },
     { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementWidth, (intptr_t)0 },
@@ -61,7 +60,7 @@ static JSC_CONST_HASHTABLE HashTable JSSVGFEFloodElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEFloodElementTableValues, 0 };
 #else
-    { 34, 31, JSSVGFEFloodElementTableValues, 0 };
+    { 18, 15, JSSVGFEFloodElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -92,8 +91,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFEFloodElementConstructor::s_info = { "SVGFEFloodElementConstructor", 0, &JSSVGFEFloodElementConstructorTable, 0 };
@@ -162,15 +164,6 @@ bool JSSVGFEFloodElement::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, descriptor);
 }
 
-JSValue jsSVGFEFloodElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThis->impl());
-    RefPtr<SVGAnimatedString> obj = imp->in1Animated();
-    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
-}
-
 JSValue jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
index a87b884..2dccbf8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEFloodElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -69,7 +73,6 @@ public:
 JSC::JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsSVGFEFloodElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
index 7956656..9165733 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncAElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
index d6c8c74..712f096 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncBElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
index d9e1767..ecb6430 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
index 179a254..f338fae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEFuncRElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
index 1227008..7715726 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEGaussianBlurElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
index a21a67b..616d7e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
index 501ce85..112f064 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEMergeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
index 5f055ee..966eacf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEMergeNodeElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
new file mode 100644
index 0000000..b8b7ae5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.cpp
@@ -0,0 +1,336 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+
+#include "JSSVGFEMorphologyElement.h"
+
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSStyleDeclaration.h"
+#include "CSSValue.h"
+#include "JSCSSStyleDeclaration.h"
+#include "JSCSSValue.h"
+#include "JSSVGAnimatedEnumeration.h"
+#include "JSSVGAnimatedLength.h"
+#include "JSSVGAnimatedNumber.h"
+#include "JSSVGAnimatedString.h"
+#include "SVGFEMorphologyElement.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMorphologyElement);
+
+/* Hash table */
+
+static const HashTableValue JSSVGFEMorphologyElementTableValues[13] =
+{
+    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementIn1, (intptr_t)0 },
+    { "operator", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementOperator, (intptr_t)0 },
+    { "radiusX", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementRadiusX, (intptr_t)0 },
+    { "radiusY", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementRadiusY, (intptr_t)0 },
+    { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementX, (intptr_t)0 },
+    { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementY, (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementWidth, (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementHeight, (intptr_t)0 },
+    { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementResult, (intptr_t)0 },
+    { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementClassName, (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementStyle, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEMorphologyElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSSVGFEMorphologyElementTableValues, 0 };
+#else
+    { 34, 31, JSSVGFEMorphologyElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEMorphologyElementConstructorTableValues[4] =
+{
+    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSSVGFEMorphologyElementConstructorTableValues, 0 };
+#else
+    { 8, 7, JSSVGFEMorphologyElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEMorphologyElementConstructor : public DOMConstructorObject {
+public:
+    JSSVGFEMorphologyElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSSVGFEMorphologyElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEMorphologyElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSSVGFEMorphologyElementConstructor::s_info = { "SVGFEMorphologyElementConstructor", 0, &JSSVGFEMorphologyElementConstructorTable, 0 };
+
+bool JSSVGFEMorphologyElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEMorphologyElementConstructor, DOMObject>(exec, &JSSVGFEMorphologyElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMorphologyElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMorphologyElementConstructor, DOMObject>(exec, &JSSVGFEMorphologyElementConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSSVGFEMorphologyElementPrototypeTableValues[6] =
+{
+    { "SVG_MORPHOLOGY_OPERATOR_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_ERODE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE, (intptr_t)0 },
+    { "SVG_MORPHOLOGY_OPERATOR_DILATE", DontDelete|ReadOnly, (intptr_t)jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE, (intptr_t)0 },
+    { "setRadius", DontDelete|Function, (intptr_t)jsSVGFEMorphologyElementPrototypeFunctionSetRadius, (intptr_t)2 },
+    { "getPresentationAttribute", DontDelete|Function, (intptr_t)jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSVGFEMorphologyElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSSVGFEMorphologyElementPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSSVGFEMorphologyElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSSVGFEMorphologyElementPrototype::s_info = { "SVGFEMorphologyElementPrototype", 0, &JSSVGFEMorphologyElementPrototypeTable, 0 };
+
+JSObject* JSSVGFEMorphologyElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSSVGFEMorphologyElement>(exec, globalObject);
+}
+
+bool JSSVGFEMorphologyElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticPropertySlot<JSSVGFEMorphologyElementPrototype, JSObject>(exec, &JSSVGFEMorphologyElementPrototypeTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMorphologyElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFEMorphologyElementPrototype, JSObject>(exec, &JSSVGFEMorphologyElementPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSSVGFEMorphologyElement::s_info = { "SVGFEMorphologyElement", &JSSVGElement::s_info, &JSSVGFEMorphologyElementTable, 0 };
+
+JSSVGFEMorphologyElement::JSSVGFEMorphologyElement(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEMorphologyElement> impl)
+    : JSSVGElement(structure, globalObject, impl)
+{
+}
+
+JSObject* JSSVGFEMorphologyElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSSVGFEMorphologyElementPrototype(JSSVGFEMorphologyElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
+}
+
+bool JSSVGFEMorphologyElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEMorphologyElement, Base>(exec, &JSSVGFEMorphologyElementTable, this, propertyName, slot);
+}
+
+bool JSSVGFEMorphologyElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMorphologyElement, Base>(exec, &JSSVGFEMorphologyElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsSVGFEMorphologyElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedString> obj = imp->in1Animated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementOperator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedEnumeration> obj = imp->_operatorAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementRadiusX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedNumber> obj = imp->radiusXAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementRadiusY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedNumber> obj = imp->radiusYAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
+    return toJS(exec, castedThis->globalObject(), obj.get(), imp);
+}
+
+JSValue jsSVGFEMorphologyElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* castedThis = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+}
+
+JSValue jsSVGFEMorphologyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSVGFEMorphologyElement* domObject = static_cast<JSSVGFEMorphologyElement*>(asObject(slot.slotBase()));
+    return JSSVGFEMorphologyElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSSVGFEMorphologyElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSSVGFEMorphologyElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionSetRadius(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSSVGFEMorphologyElement::s_info))
+        return throwError(exec, TypeError);
+    JSSVGFEMorphologyElement* castedThisObj = static_cast<JSSVGFEMorphologyElement*>(asObject(thisValue));
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThisObj->impl());
+    float radiusX = args.at(0).toFloat(exec);
+    float radiusY = args.at(1).toFloat(exec);
+
+    imp->setRadius(radiusX, radiusY);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSSVGFEMorphologyElement::s_info))
+        return throwError(exec, TypeError);
+    JSSVGFEMorphologyElement* castedThisObj = static_cast<JSSVGFEMorphologyElement*>(asObject(thisValue));
+    SVGFEMorphologyElement* imp = static_cast<SVGFEMorphologyElement*>(castedThisObj->impl());
+    const UString& name = args.at(0).toString(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getPresentationAttribute(name)));
+    return result;
+}
+
+// Constant getters
+
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+
+}
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
new file mode 100644
index 0000000..8db6463
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMorphologyElement.h
@@ -0,0 +1,99 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSVGFEMorphologyElement_h
+#define JSSVGFEMorphologyElement_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+
+#include "JSSVGElement.h"
+#include "SVGElement.h"
+
+namespace WebCore {
+
+class SVGFEMorphologyElement;
+
+class JSSVGFEMorphologyElement : public JSSVGElement {
+    typedef JSSVGElement Base;
+public:
+    JSSVGFEMorphologyElement(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEMorphologyElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSSVGFEMorphologyElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+    JSSVGFEMorphologyElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionSetRadius(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEMorphologyElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsSVGFEMorphologyElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementOperator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementRadiusX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementRadiusY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+// Constants
+
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_ERODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMorphologyElementSVG_MORPHOLOGY_OPERATOR_DILATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
index 0128ea8..3d7387e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFEOffsetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
index 89b64e9..fa8fe77 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFEPointLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
index 7ee5759..09c903f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFESpecularLightingElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
index aae0f88..8a3a4ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFESpotLightElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
index ed9d87b..f1e489e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFETileElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
index a302215..845cdb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
@@ -106,8 +106,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGFETurbulenceElementConstructor::s_info = { "SVGFETurbulenceElementConstructor", 0, &JSSVGFETurbulenceElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
index f8c35f2..7d100b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFETurbulenceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
index 343c406..9e0b45f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGFilterElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
index 289dc62..e6ce8a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
index 84cda77..87d2243 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
index 36f0094..9ffb7b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceFormatElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
index 8504888..1abfcbb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceNameElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
index 2fb2971..1a154ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceSrcElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
index e58cf9d..eede5c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGFontFaceUriElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
index fa75e42..6e8121a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGForeignObjectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
index b4885f9..7c6aa85 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
index 38834f0..05f62df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
index 7c9b33b..4286016 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
@@ -97,8 +97,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGGradientElementConstructor::s_info = { "SVGGradientElementConstructor", 0, &JSSVGGradientElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
index dbfd6e0..3207003 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
index 17394ba..aeab2d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGHKernElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
index 7319718..97bc1e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGImageElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index 0f545f8..f97df89 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -95,8 +95,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGLengthConstructor::s_info = { "SVGLengthConstructor", 0, &JSSVGLengthConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
index 25f5729..e6c66f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -61,6 +61,8 @@ public:
 
 private:
     RefPtr<JSSVGPODTypeWrapper<SVGLength> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
@@ -76,9 +78,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGLengthPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
index 7ed12ca..bd9adda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGLengthList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGLengthList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGLengthList*, SVGElement* context);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGLengthListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
index b9eeb3d..1089b37 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGLineElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
index e71ffe3..ea2f85d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGLinearGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
index c712ba8..add8265 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
@@ -112,8 +112,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGMarkerElementConstructor::s_info = { "SVGMarkerElementConstructor", 0, &JSSVGMarkerElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
index b70410d..ca04951 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
@@ -43,10 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGMarkerElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
index b391d02..042ba89 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGMaskElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
index 9c9ece7..6a9d2af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -58,6 +58,8 @@ public:
 
 private:
     RefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
@@ -73,9 +75,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGMatrixPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
index 0195ff6..462b52d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGMetadataElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
index d891881..d3584bd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGMissingGlyphElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
index 4aaeaf9..cf3bc5c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     JSSVGPODTypeWrapper<float> * impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JSSVGPODTypeWrapper<float> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
@@ -64,7 +66,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGNumberPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
index 9dd4cb2..4a2cbfe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGNumberList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGNumberList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGNumberList*, SVGElement* context);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGNumberListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
index 1f86378..c523ddd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
@@ -92,8 +92,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGPaintConstructor::s_info = { "SVGPaintConstructor", 0, &JSSVGPaintConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
index 7ef72ed..deaa540 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPaintPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
index 64b0504..b02974b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index f31f795..2f1ecbd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -101,8 +101,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGPathSegConstructor::s_info = { "SVGPathSegConstructor", 0, &JSSVGPathSegConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
index d648d64..d5da317 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGPathSeg> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPathSeg*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPathSegPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
index 6c99037..9b7eeec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegArcAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
index d6af11b..819d791 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegArcRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
index a20af24..bccce45 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegClosePathPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
index ac4640f..b1c676f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
index 848cce1..0e5cba9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
index a54e166..478a81d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicSmoothAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
index 8b0463f..799df23 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoCubicSmoothRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
index edb17bd..e29bb76 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
index 8286761..d348b02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
index 9ffcea7..9cf1562 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
index 199fad7..9b2d888 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
index 1cdc6ff..bcd5ee1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
index b4aa488..314570b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoHorizontalAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
index 004a444..8df3aba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoHorizontalRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
index 8b8faa6..f9a1c1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
index 45b5ee2..6258a0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoVerticalAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
index 95230b1..7355926 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegLinetoVerticalRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
index d9d7040..120fc96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGPathSegList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPathSegList*, SVGElement* context);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPathSegListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
index f7781ac..b81a644 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegMovetoAbsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
index 93cec0e..57b606b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGPathSegMovetoRelPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
index d1ce76a..6cd8a73 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPatternElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
index 93cb8e0..97ec466 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
@@ -47,13 +47,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     JSSVGPODTypeWrapper<FloatPoint> * impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JSSVGPODTypeWrapper<FloatPoint> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPointPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
index e8b783f..c029a46 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGPointList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPointList*, SVGElement* context);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPointListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
index e1cbd06..0eeac84 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPolygonElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
index 3a654d3..bd58c78 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPolylineElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index 0345319..0f3329c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -93,8 +93,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGPreserveAspectRatioConstructor::s_info = { "SVGPreserveAspectRatioConstructor", 0, &JSSVGPreserveAspectRatioConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
index 26ed465..32f1661 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<SVGPreserveAspectRatio> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGPreserveAspectRatio*, SVGElement* context);
@@ -70,9 +72,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGPreserveAspectRatioPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
index a284b03..a4c3b87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGRadialGradientElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
index 0a99542..209e365 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
@@ -47,13 +47,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     JSSVGPODTypeWrapper<FloatRect> * impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JSSVGPODTypeWrapper<FloatRect> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
@@ -65,7 +67,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
index 94b753a..7572ac1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGRectElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index 7d645fd..b484fbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGRenderingIntentConstructor::s_info = { "SVGRenderingIntentConstructor", 0, &JSSVGRenderingIntentConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
index 4a0f363..16fcff2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGRenderingIntent> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGRenderingIntent*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGRenderingIntentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
index 9ef7c3f..91ec122 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGSVGElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
index 5ddcded..bc4a7eb4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGScriptElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
index 39c660d..1dee3f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGSetElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
index 2269249..9dc52b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGStopElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
index 5299968..b328bac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
@@ -46,13 +46,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SVGStringList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGStringList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGStringList*, SVGElement* context);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGStringListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
index 1cf73b2..608c278 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -55,7 +57,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGStyleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
index c1a6099..a91244f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGSwitchElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
index c4dc23b..c430257 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGSymbolElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
index 6d24e83..74ab8c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGTRefElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
index 6529758..cb9df9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
@@ -38,6 +38,13 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
@@ -47,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGTSpanElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
index dc8dfae..31a570f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
@@ -108,8 +108,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGTextContentElementConstructor::s_info = { "SVGTextContentElementConstructor", 0, &JSSVGTextContentElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
index 35db44b..5bbe15f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
@@ -43,10 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTextContentElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
index 0f0959d..d605de3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTextElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
index b4f0c20..d952072 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGTextPathElementConstructor::s_info = { "SVGTextPathElementConstructor", 0, &JSSVGTextPathElementConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
index ada62bf..cf883be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
@@ -42,10 +42,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTextPathElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
index f861e89..04d1db3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGTextPositioningElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
index 9972b69..67a353d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTitleElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index 4a67764..82cddb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGTransformConstructor::s_info = { "SVGTransformConstructor", 0, &JSSVGTransformConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
index bce97e5..592af87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<JSSVGPODTypeWrapper<SVGTransform> > m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTransformPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
index 36ff356..a8fe9e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -62,6 +62,8 @@ public:
 
 private:
     RefPtr<SVGTransformList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGTransformList*, SVGElement* context);
@@ -77,9 +79,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGTransformListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index 683398f..452fc9c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSSVGUnitTypesConstructor::s_info = { "SVGUnitTypesConstructor", 0, &JSSVGUnitTypesConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
index 4d92f84..0c20046 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<SVGUnitTypes> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SVGUnitTypes*, SVGElement* context);
@@ -69,9 +71,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGUnitTypesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
index 2c9f142..c5665c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGUseElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
index bfeda85..db1533f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
@@ -43,9 +43,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -59,9 +61,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSVGViewElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
index b3a34c6..19bd2e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
@@ -42,9 +42,11 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -54,7 +56,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSVGZoomEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.h b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
index 7a54e9c..01a4545 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     Screen* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Screen> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Screen*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSScreenPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
index a622e83..55d5f4f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -51,6 +51,8 @@ public:
     {
         return static_cast<SharedWorker*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SharedWorker*);
@@ -64,9 +66,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSSharedWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
index 21543e5..65cfada 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
@@ -42,13 +42,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     SharedWorkerContext* impl() const
     {
         return static_cast<SharedWorkerContext*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 SharedWorkerContext* toSharedWorkerContext(JSC::JSValue);
@@ -59,7 +61,13 @@ public:
     void* operator new(size_t, JSC::JSGlobalData*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSSharedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index 54f6c7d..998b8cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStorageConstructor::s_info = { "StorageConstructor", 0, &JSStorageConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.h b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
index 1d15472..e2dea63 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
@@ -47,7 +47,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
@@ -57,6 +57,8 @@ public:
 
 private:
     RefPtr<Storage> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
     static bool canGetItemsForName(JSC::ExecState*, Storage*, const JSC::Identifier&);
     static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -75,9 +77,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStoragePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
index f467736..bc8468c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
@@ -24,8 +24,6 @@
 
 #include "JSStorageEvent.h"
 
-#include "DOMWindow.h"
-#include "JSDOMWindow.h"
 #include "JSStorage.h"
 #include "KURL.h"
 #include "Storage.h"
@@ -42,13 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent);
 
 /* Hash table */
 
-static const HashTableValue JSStorageEventTableValues[8] =
+static const HashTableValue JSStorageEventTableValues[7] =
 {
     { "key", DontDelete|ReadOnly, (intptr_t)jsStorageEventKey, (intptr_t)0 },
     { "oldValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventOldValue, (intptr_t)0 },
     { "newValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventNewValue, (intptr_t)0 },
     { "uri", DontDelete|ReadOnly, (intptr_t)jsStorageEventUri, (intptr_t)0 },
-    { "source", DontDelete|ReadOnly, (intptr_t)jsStorageEventSource, (intptr_t)0 },
     { "storageArea", DontDelete|ReadOnly, (intptr_t)jsStorageEventStorageArea, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsStorageEventConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
@@ -89,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStorageEventConstructor::s_info = { "StorageEventConstructor", 0, &JSStorageEventConstructorTable, 0 };
@@ -109,7 +109,7 @@ bool JSStorageEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSStorageEventPrototypeTableValues[2] =
 {
-    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)9 },
+    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)8 },
     { 0, 0, 0, 0 }
 };
 
@@ -191,14 +191,6 @@ JSValue jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot
     return jsString(exec, imp->uri());
 }
 
-JSValue jsStorageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    StorageEvent* imp = static_cast<StorageEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->source()));
-}
-
 JSValue jsStorageEventStorageArea(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
@@ -231,10 +223,9 @@ JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(ExecState*
     const UString& oldValueArg = valueToStringWithNullCheck(exec, args.at(4));
     const UString& newValueArg = valueToStringWithNullCheck(exec, args.at(5));
     const UString& uriArg = args.at(6).toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(7));
-    Storage* storageAreaArg = toStorage(args.at(8));
+    Storage* storageAreaArg = toStorage(args.at(7));
 
-    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, sourceArg, storageAreaArg);
+    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, storageAreaArg);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
index bfd8a67..a9552c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
@@ -41,10 +41,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -58,9 +60,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStorageEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
@@ -72,7 +76,6 @@ JSC::JSValue jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JS
 JSC::JSValue jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsStorageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventStorageArea(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index bfa30f4..ae7011d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStyleSheetConstructor::s_info = { "StyleSheetConstructor", 0, &JSStyleSheetConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
index 6c67955..cfdd964 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,6 +54,8 @@ public:
 
 private:
     RefPtr<StyleSheet> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, StyleSheet*);
@@ -67,9 +69,11 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index aa1d6bd..5d07cc1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSStyleSheetListConstructor::s_info = { "StyleSheetListConstructor", 0, &JSStyleSheetListConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
index 757b8ad..7b518aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -55,6 +55,8 @@ public:
 
 private:
     RefPtr<StyleSheetList> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, StyleSheetList*, const JSC::Identifier&);
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSStyleSheetListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.cpp b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
index d90e3f2..62ba04b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTextConstructor::s_info = { "TextConstructor", 0, &JSTextConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.h b/src/3rdparty/webkit/WebCore/generated/JSText.h
index dc31f61..2c53691 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJSNewlyCreated(JSC::ExecState*, JSDOMGlobalObject*, Text*);
@@ -57,9 +59,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
index 3ddab29..3a5c4d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
@@ -78,8 +78,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTextEventConstructor::s_info = { "TextEventConstructor", 0, &JSTextEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
index 19e77ce..576d55e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTextEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index b267f76..627ad3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -75,8 +75,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTextMetricsConstructor::s_info = { "TextMetricsConstructor", 0, &JSTextMetricsConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
index 9e3968a..9cf013f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<TextMetrics> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TextMetrics*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSTextMetricsPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
index 0db2dff..201df06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     TimeRanges* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<TimeRanges> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TimeRanges*);
@@ -67,9 +69,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTimeRangesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index fe72cad..a26425e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -84,8 +84,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSTreeWalkerConstructor::s_info = { "TreeWalkerConstructor", 0, &JSTreeWalkerConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
index 091bdd0..3daf9e8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -63,6 +63,8 @@ public:
 
 private:
     RefPtr<TreeWalker> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TreeWalker*);
@@ -78,9 +80,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSTreeWalkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
index 236845e..1aa2963 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSUIEventConstructor::s_info = { "UIEventConstructor", 0, &JSUIEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
index b9658a4..19f8ed2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSUIEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
index 760480c..ece0459 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
@@ -43,13 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     ValidityState* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<ValidityState> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ValidityState*);
@@ -61,7 +63,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSValidityStatePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
index 9b82bb2..da043af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
@@ -39,10 +39,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     VoidCallback* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<VoidCallback> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, VoidCallback*);
@@ -58,9 +65,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSVoidCallbackPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
index 9dbd396..e5a3892 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitAnimationEventConstructor::s_info = { "WebKitAnimationEventConstructor", 0, &JSWebKitAnimationEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
index 1631bad..e4e622a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitAnimationEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
index cb7a615..e801d63 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitCSSKeyframeRuleConstructor::s_info = { "WebKitCSSKeyframeRuleConstructor", 0, &JSWebKitCSSKeyframeRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
index 5fea55d..98289d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
@@ -40,10 +40,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -53,7 +55,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWebKitCSSKeyframeRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
index 5538ba7..6ea3237 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitCSSKeyframesRuleConstructor::s_info = { "WebKitCSSKeyframesRuleConstructor", 0, &JSWebKitCSSKeyframesRuleConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
index 73d10cf..e76ba2a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
@@ -41,11 +41,13 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
@@ -60,9 +62,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitCSSKeyframesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
index 83c2c3d..3823098 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     WebKitCSSMatrix* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WebKitCSSMatrix> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebKitCSSMatrix*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitCSSMatrixPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
index 0c2fa6c..b62daea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
@@ -96,8 +96,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitCSSTransformValueConstructor::s_info = { "WebKitCSSTransformValueConstructor", 0, &JSWebKitCSSTransformValueConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
index 6fc7d2a..bb819bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitCSSTransformValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
index 885040d..319980d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
@@ -44,13 +44,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     WebKitPoint* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WebKitPoint> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebKitPoint*);
@@ -62,7 +64,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWebKitPointPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
index b4c83b4..20066f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
@@ -79,8 +79,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWebKitTransitionEventConstructor::s_info = { "WebKitTransitionEventConstructor", 0, &JSWebKitTransitionEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
index e649dc4..015574c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -56,9 +58,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebKitTransitionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
index 44fa960..ea8ff3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
@@ -24,9 +24,11 @@
 
 #include "JSWebSocket.h"
 
+#include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
+#include "JSEvent.h"
 #include "JSEventListener.h"
 #include "KURL.h"
 #include "RegisteredEventListener.h"
@@ -64,13 +66,16 @@ static JSC_CONST_HASHTABLE HashTable JSWebSocketTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWebSocketPrototypeTableValues[6] =
+static const HashTableValue JSWebSocketPrototypeTableValues[9] =
 {
     { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsWebSocketCONNECTING, (intptr_t)0 },
     { "OPEN", DontDelete|ReadOnly, (intptr_t)jsWebSocketOPEN, (intptr_t)0 },
     { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsWebSocketCLOSED, (intptr_t)0 },
     { "send", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionSend, (intptr_t)1 },
     { "close", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionClose, (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionAddEventListener, (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionDispatchEvent, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -257,6 +262,40 @@ JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionClose(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    return castedThisObj->addEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    return castedThisObj->removeEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    WebSocket* imp = static_cast<WebSocket*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* evt = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
 // Constant getters
 
 JSValue jsWebSocketCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
index 0632872..9428212 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
@@ -46,7 +46,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -54,10 +54,14 @@ public:
 
     // Custom functions
     JSC::JSValue send(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     WebSocket* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WebSocket> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebSocket*);
@@ -73,15 +77,20 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWebSocketPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
 
 JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsWebSocketURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
index e60e32c..589f570 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
@@ -89,8 +89,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWheelEventConstructor::s_info = { "WheelEventConstructor", 0, &JSWheelEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
index ae8aa6a..6901d93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWheelEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.h b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
index 3aa7221..28f2e38 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
 
@@ -53,6 +53,8 @@ public:
     {
         return static_cast<Worker*>(Base::impl());
     }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Worker*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
index 37d6c87..f44ba01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -61,6 +61,8 @@ public:
     JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -74,9 +76,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index 7b634ae..e24d0d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -87,8 +87,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSWorkerLocationConstructor::s_info = { "WorkerLocationConstructor", 0, &JSWorkerLocationConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
index 0002c4c..e7d8062 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<WorkerLocation> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WorkerLocation*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSWorkerLocationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
index 92e0094..f459679 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
@@ -45,13 +45,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     WorkerNavigator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WorkerNavigator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WorkerNavigator*);
@@ -63,7 +65,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSWorkerNavigatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
index 0582f1e..5c05753 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -65,6 +65,8 @@ public:
 
 private:
     RefPtr<XMLHttpRequest> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLHttpRequest*);
@@ -80,9 +82,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLHttpRequestPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 45908b3..30e0d72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -82,8 +82,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXMLHttpRequestExceptionConstructor::s_info = { "XMLHttpRequestExceptionConstructor", 0, &JSXMLHttpRequestExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
index f04fdf5..54dcfde 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<XMLHttpRequestException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLHttpRequestException*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLHttpRequestExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
index 4baf3f1..6343a1b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
@@ -76,8 +76,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXMLHttpRequestProgressEventConstructor::s_info = { "XMLHttpRequestProgressEventConstructor", 0, &JSXMLHttpRequestProgressEventConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
index f12a906..6486dd7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
@@ -39,10 +39,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 
@@ -52,7 +54,13 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
     JSXMLHttpRequestProgressEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index 8c44709..bc5fff9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXMLHttpRequestUploadConstructor::s_info = { "XMLHttpRequestUploadConstructor", 0, &JSXMLHttpRequestUploadConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
index fdf98ac..a613e6d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
@@ -44,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -58,6 +58,8 @@ public:
 
 private:
     RefPtr<XMLHttpRequestUpload> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLHttpRequestUpload*);
@@ -73,9 +75,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLHttpRequestUploadPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index 1dcfc94..e6cdd6b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -77,8 +77,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
     static JSObject* constructXMLSerializer(ExecState* exec, JSObject* constructor, const ArgList&)
     {
         return asObject(toJS(exec, static_cast<JSXMLSerializerConstructor*>(constructor)->globalObject(), XMLSerializer::create()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
index e8b08c8..fd50d5d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -51,6 +51,8 @@ public:
 
 private:
     RefPtr<XMLSerializer> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XMLSerializer*);
@@ -66,9 +68,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXMLSerializerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index 4ce95ca..e25be26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -86,8 +86,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
     static JSObject* constructXPathEvaluator(ExecState* exec, JSObject* constructor, const ArgList&)
     {
         return asObject(toJS(exec, static_cast<JSXPathEvaluatorConstructor*>(constructor)->globalObject(), XPathEvaluator::create()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
index 997f066..9b37465 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathEvaluator> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathEvaluator*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathEvaluatorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index 7911fad..3894ac2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -85,8 +85,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXPathExceptionConstructor::s_info = { "XPathExceptionConstructor", 0, &JSXPathExceptionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
index a33d9a1..f73ba88 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathException> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathException*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index d5531e5..9464146 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -80,8 +80,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXPathExpressionConstructor::s_info = { "XPathExpressionConstructor", 0, &JSXPathExpressionConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
index a3b2bd1..f5fd0dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathExpression> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathExpression*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathExpressionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
index 3e28973..86ce543 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
@@ -41,10 +41,17 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
     XPathNSResolver* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathNSResolver> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathNSResolver*);
@@ -60,9 +67,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathNSResolverPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index 82387c6..337f473 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -99,8 +99,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 };
 
 const ClassInfo JSXPathResultConstructor::s_info = { "XPathResultConstructor", 0, &JSXPathResultConstructorTable, 0 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
index 4c5a467..a8db49e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
@@ -45,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -53,6 +53,8 @@ public:
 
 private:
     RefPtr<XPathResult> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XPathResult*);
@@ -68,9 +70,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXPathResultPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
index b9c061c..821dca7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
@@ -41,6 +41,11 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+    }
+
 
     // Custom functions
     JSC::JSValue importStylesheet(JSC::ExecState*, const JSC::ArgList&);
@@ -53,6 +58,8 @@ public:
 
 private:
     RefPtr<XSLTProcessor> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XSLTProcessor*);
@@ -68,9 +75,11 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
     }
     JSXSLTProcessorPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 };
 
 // Functions
diff --git a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
index bbbd75e..2d411d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue stringTableValues[33] = {
+static const struct HashTableValue stringTableValues[36] = {
    { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
    { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
@@ -37,9 +37,12 @@ static const struct HashTableValue stringTableValues[33] = {
    { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
    { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
    { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
 extern JSC_CONST_HASHTABLE HashTable stringTable =
-    { 71, 63, stringTableValues, 0 };
+    { 133, 127, stringTableValues, 0 };
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index 6f0af23..d7f1f85 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -1,8 +1,9 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8636];
+extern const char htmlUserAgentStyleSheet[8729];
 extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
 extern const char sourceUserAgentStyleSheet[2004];
 extern const char wmlUserAgentStyleSheet[3039];
 extern const char mediaControlsUserAgentStyleSheet[2582];
+extern const char mediaControlsQtUserAgentStyleSheet[2249];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index 8b8d7f3..7a18470 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -1,5 +1,5 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8636] = {
+extern const char htmlUserAgentStyleSheet[8729] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 49, 57, 57,
     57, 47, 120, 104, 116, 109, 108, 34, 59, 32, 104, 116, 109, 108, 32, 123,
@@ -244,302 +244,308 @@ extern const char htmlUserAgentStyleSheet[8636] = {
     101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102,
     105, 101, 108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116,
     116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110,
-    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101,
-    120, 116, 97, 114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120,
-    116, 97, 114, 101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
-    100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105,
-    100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111,
-    114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115,
-    101, 108, 101, 99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58,
-    32, 118, 101, 114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122,
-    101, 58, 32, 97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58,
-    32, 97, 117, 116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32,
-    50, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
-    58, 32, 112, 114, 101, 45, 119, 114, 97, 112, 59, 32, 119, 111, 114, 100,
-    45, 119, 114, 97, 112, 58, 32, 98, 114, 101, 97, 107, 45, 119, 111, 114,
-    100, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104,
-    111, 108, 100, 101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108,
-    97, 99, 101, 104, 111, 108, 100, 101, 114, 44, 32, 116, 101, 120, 116, 97,
-    114, 101, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
-    117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123,
-    32, 99, 111, 108, 111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105,
-    116, 121, 58, 32, 100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116,
-    97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
-    108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105,
-    97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105,
-    116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100,
-    45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110,
+    112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
+    117, 116, 45, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110, 32, 123,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
+    110, 99, 101, 58, 32, 108, 105, 115, 116, 45, 98, 117, 116, 116, 111, 110,
+    59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110,
+    101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101, 120, 116, 97,
+    114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
+    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 97, 114,
+    101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
+    111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114,
+    100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101,
+    114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
+    99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 118, 101,
+    114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122, 101, 58, 32,
+    97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117,
+    116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120,
+    59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112,
+    114, 101, 45, 119, 114, 97, 112, 59, 32, 119, 111, 114, 100, 45, 119, 114,
+    97, 112, 58, 32, 98, 114, 101, 97, 107, 45, 119, 111, 114, 100, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100,
+    101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101,
+    104, 111, 108, 100, 101, 114, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45,
+    112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123, 32, 99, 111,
+    108, 111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115,
+    115, 119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105, 116, 121, 58,
+    32, 100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116,
     59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101,
-    108, 105, 110, 101, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110,
-    58, 32, 115, 116, 97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97,
-    110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98,
+    104, 105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
+    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111,
+    108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111,
+    114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
+    101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110,
+    101, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 115,
+    116, 97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59,
+    32, 125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98, 97, 99, 107,
+    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 98, 97,
+    99, 107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103, 101, 58, 110,
+    111, 110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97,
+    100, 105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32,
+    109, 97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48, 46, 53, 101,
+    120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116,
+    105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
+    99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
+    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98,
+    117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
+    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104, 45, 98, 117,
+    116, 116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99,
+    101, 58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
+    116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97,
+    100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97,
+    108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 116, 101,
+    120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114,
+    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108,
+    116, 59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110,
+    84, 101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50,
+    112, 120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112, 120, 59, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111, 117, 116, 115,
+    101, 116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 98,
     97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
-    32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103,
-    101, 58, 110, 111, 110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110,
-    116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 114, 97, 100, 105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93,
-    32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48,
-    46, 53, 101, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105,
-    110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
-    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97,
-    108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105,
-    97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
-    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104,
-    45, 98, 117, 116, 116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115,
-    112, 97, 99, 101, 58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117,
+    32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58,
+    32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 45, 104,
+    111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97, 100, 100, 105,
+    110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114,
+    100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105, 100, 101, 114,
+    45, 116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105,
+    100, 101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105, 122, 111, 110,
+    116, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
+    100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108,
+    111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116,
+    111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108,
+    101, 99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 107, 101,
+    121, 103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111,
+    112, 116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    44, 32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101,
+    100, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 71, 114,
+    97, 121, 84, 101, 120, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99,
+    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118,
+    101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114,
+    101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
+    93, 58, 97, 99, 116, 105, 118, 101, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116,
+    105, 118, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121,
+    108, 101, 58, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105, 110, 112, 117,
     116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
+    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
     44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
-    98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112,
+    98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105,
+    118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112,
     117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58,
+    97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58,
     58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112,
     108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116,
-    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
-    32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110,
-    116, 101, 114, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102,
-    97, 117, 108, 116, 59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116,
-    116, 111, 110, 84, 101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103,
-    58, 32, 50, 112, 120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112,
-    120, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111,
-    117, 116, 115, 101, 116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105,
-    110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110,
-    103, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101,
-    114, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97,
-    100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 109, 97, 114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103,
-    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105,
-    100, 101, 114, 45, 116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
-    115, 108, 105, 100, 101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105,
-    122, 111, 110, 116, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100,
-    105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105,
-    115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 102, 105, 108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
-    100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45,
-    117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98,
-    117, 116, 116, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
-    115, 101, 108, 101, 99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
-    32, 107, 101, 121, 103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 111, 112, 116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 44, 32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 58, 100,
-    105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 99, 111, 108, 111, 114, 58,
-    32, 71, 114, 97, 121, 84, 101, 120, 116, 32, 125, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99,
-    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
-    108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
-    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58,
-    97, 99, 116, 105, 118, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45,
-    115, 116, 121, 108, 101, 58, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111,
-    110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101,
-    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97,
-    99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
-    34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108,
-    101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101,
-    45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
-    115, 97, 98, 108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45,
-    115, 116, 121, 108, 101, 58, 32, 111, 117, 116, 115, 101, 116, 32, 125, 32,
-    97, 114, 101, 97, 44, 32, 112, 97, 114, 97, 109, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98,
-    111, 120, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 99, 104, 101, 99, 107,
-    98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121,
+    108, 101, 58, 32, 111, 117, 116, 115, 101, 116, 32, 125, 32, 97, 114, 101,
+    97, 44, 32, 112, 97, 114, 97, 109, 32, 123, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 99, 104, 101, 99, 107, 98, 111, 120,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
+    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
+    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    114, 97, 100, 105, 111, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 114, 97,
+    100, 105, 111, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
     45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
-    98, 111, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 32, 123, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
-    32, 114, 97, 100, 105, 111, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100,
-    101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 107, 101, 121, 103, 101, 110,
-    44, 32, 115, 101, 108, 101, 99, 116, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109,
-    101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114,
-    100, 101, 114, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116,
-    101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32,
-    115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
-    111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112,
-    120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
-    112, 114, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108,
-    45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99,
-    97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111,
-    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 115, 101,
-    108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101, 108, 101,
-    99, 116, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32, 115, 101,
-    108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108, 116, 105,
-    112, 108, 101, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 98,
-    111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
-    97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116, 59, 32, 98, 111,
-    114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32,
-    103, 114, 97, 121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 105, 110, 105,
-    116, 105, 97, 108, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99,
-    101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 115, 101,
-    108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 48, 34, 93, 44, 32,
-    115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 49, 34, 93,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
-    114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59,
+    98, 111, 120, 59, 32, 125, 32, 107, 101, 121, 103, 101, 110, 44, 32, 115,
+    101, 108, 101, 99, 116, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117,
+    108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114,
+    45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
+    32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108,
+    105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100,
+    101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32,
+    119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
+    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
+    32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98,
+    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
+    32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
+    100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 115, 101, 108, 101, 99,
+    116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91,
+    109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32, 115, 101, 108, 101, 99,
+    116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108, 116, 105, 112, 108, 101,
+    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 98, 111, 120, 59,
     32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105,
-    103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100,
-    101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97,
-    100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101,
-    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 125, 32, 100,
-    97, 116, 97, 108, 105, 115, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114,
-    111, 117, 112, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
-    116, 58, 32, 98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116,
-    105, 111, 110, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
-    116, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 100, 97, 116,
-    97, 103, 114, 105, 100, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32,
-    49, 53, 48, 112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 100, 97, 116, 97, 103,
-    114, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
-    45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
-    98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108,
-    45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99,
-    97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111,
-    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 98, 111, 114, 100,
-    101, 114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114,
-    97, 121, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58,
-    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105,
-    110, 115, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
-    116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32,
-    125, 32, 115, 116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111,
-    110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101,
-    114, 32, 125, 32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44,
-    32, 118, 97, 114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32,
-    102, 111, 110, 116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108,
-    105, 99, 32, 125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107,
-    98, 100, 44, 32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45,
-    102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99,
-    101, 32, 125, 32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108,
-    97, 105, 110, 116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103,
-    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99,
-    107, 59, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32,
-    109, 111, 110, 111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101,
-    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114,
-    103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32,
-    98, 105, 103, 32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58,
-    32, 108, 97, 114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32,
-    123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97,
-    108, 108, 101, 114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101,
-    44, 32, 100, 101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99,
-    111, 114, 97, 116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104,
-    114, 111, 117, 103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101,
-    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117,
-    98, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109,
-    97, 108, 108, 101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101,
-    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117,
-    112, 101, 114, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32,
-    115, 109, 97, 108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123,
-    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111,
-    119, 114, 97, 112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32,
-    111, 117, 116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112,
-    120, 32, 45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45,
-    114, 105, 110, 103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109,
-    108, 58, 102, 111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111,
-    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111,
-    110, 108, 121, 93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116,
-    108, 105, 110, 101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112,
-    117, 116, 58, 102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114,
-    101, 97, 58, 102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101,
-    120, 58, 102, 111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58,
-    102, 111, 99, 117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111,
-    99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102,
-    102, 115, 101, 116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34,
-    93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58,
-    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
-    100, 101, 110, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93,
-    58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117,
-    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114,
-    101, 115, 101, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104,
-    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102,
+    103, 110, 58, 32, 115, 116, 97, 114, 116, 59, 32, 98, 111, 114, 100, 101,
+    114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97,
+    121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101,
+    114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
+    105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 115, 101, 108, 101, 99,
+    116, 91, 115, 105, 122, 101, 61, 34, 48, 34, 93, 44, 32, 115, 101, 108,
+    101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 49, 34, 93, 32, 123, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
+    99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58,
+    32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117,
+    115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112,
+    97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 125, 32, 100, 97, 116, 97,
+    108, 105, 115, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112,
+    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
+    98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110,
+    32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32,
+    110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 100, 97, 116, 97, 103, 114,
+    105, 100, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 53, 48,
+    112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 100, 97, 116, 97, 103, 114, 105, 100,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
+    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
+    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
+    32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98,
+    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
+    32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
+    100, 101, 102, 97, 117, 108, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59,
+    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110,
+    105, 116, 105, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32,
+    123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111,
+    110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115,
+    116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45,
+    119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125,
+    32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97,
+    114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110,
+    116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32,
+    125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44,
+    32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109,
+    105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125,
+    32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110,
+    116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
+    102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110,
+    111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112,
+    97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110,
+    58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103,
+    32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97,
+    114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102,
+    111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101,
+    114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100,
+    101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
+    116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117,
+    103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105,
+    99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32,
+    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108,
+    101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105,
+    99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114,
+    59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97,
+    108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104,
+    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97,
+    112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116,
+    108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110,
+    103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102,
+    111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115,
+    44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121,
+    93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110,
+    101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58,
+    102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102,
+    111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99,
+    117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115,
+    32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101,
+    116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102,
     111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108,
-    111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116,
-    108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125,
-    32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108,
-    105, 110, 107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45,
-    100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101,
-    114, 108, 105, 110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97,
-    117, 116, 111, 59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101,
+    61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99,
+    117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110,
+    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111,
+    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101,
+    116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117,
+    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110,
+    101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107,
     32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110,
-    111, 102, 114, 97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115,
-    101, 116, 44, 32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97,
-    109, 101, 115, 101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99,
-    111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32,
-    105, 102, 114, 97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58,
-    32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 32, 125
+    116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99,
+    111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105,
+    110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111,
+    59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110,
+    121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32,
+    99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114,
+    97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44,
+    32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115,
+    101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111,
+    114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114,
+    97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112,
+    120, 32, 105, 110, 115, 101, 116, 32, 125
 };
 extern const char quirksUserAgentStyleSheet[359] = {
     105, 109, 103, 91, 97, 108, 105, 103, 110, 61, 34, 108, 101, 102, 116, 34,
@@ -1075,4 +1081,147 @@ extern const char mediaControlsUserAgentStyleSheet[2582] = {
     116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
     111, 110, 101, 59, 32, 125
 };
+extern const char mediaControlsQtUserAgentStyleSheet[2249] = {
+    97, 117, 100, 105, 111, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32,
+    51, 52, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 52, 48, 48,
+    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 112, 97, 110, 101, 108, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114, 105, 122,
+    111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 101, 110, 100, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
+    99, 116, 58, 32, 110, 111, 110, 101, 59, 32, 112, 111, 115, 105, 116, 105,
+    111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 98, 111,
+    116, 116, 111, 109, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32,
+    49, 48, 48, 37, 59, 32, 122, 45, 105, 110, 100, 101, 120, 58, 32, 48,
+    59, 32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32, 104, 105, 100, 100,
+    101, 110, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 48, 48, 37,
+    59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 114, 105,
+    103, 104, 116, 59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45, 109,
+    101, 100, 105, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110,
+    101, 108, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 44,
+    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109,
+    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102,
+    116, 58, 32, 97, 117, 116, 111, 59, 32, 114, 105, 103, 104, 116, 58, 32,
+    53, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 50, 112, 120,
+    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120, 59, 32,
+    112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 59, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 53, 112, 120, 32, 53, 112,
+    120, 32, 51, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116,
+    111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32,
+    108, 101, 102, 116, 58, 32, 53, 112, 120, 59, 32, 119, 105, 100, 116, 104,
+    58, 32, 57, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49,
+    50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112,
+    120, 32, 49, 50, 112, 120, 32, 54, 112, 120, 32, 49, 49, 112, 120, 59,
+    32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 51, 112, 120,
+    32, 53, 112, 120, 32, 53, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105,
+    110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105,
+    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101,
+    108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 32, 123,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 51, 52, 112, 120, 59, 32, 125,
+    32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99,
+    117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112,
+    108, 97, 121, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45,
+    100, 105, 115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101,
+    109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44,
+    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116,
+    105, 109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105,
+    115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44,
+    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
+    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116,
+    105, 109, 101, 108, 105, 110, 101, 32, 123, 32, 108, 101, 102, 116, 58, 32,
+    52, 50, 112, 120, 59, 32, 114, 105, 103, 104, 116, 58, 32, 51, 52, 112,
+    120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 50, 112, 120, 59,
+    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 54, 112, 120, 32, 56, 112,
+    120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 53, 112, 120, 32, 48,
+    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
+    114, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 44, 32, 118, 105, 100,
+    101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108, 117, 109,
+    101, 45, 115, 108, 105, 100, 101, 114, 45, 99, 111, 110, 116, 97, 105, 110,
+    101, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
+    114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32,
+    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110,
+    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110,
+    32, 123, 32, 108, 101, 102, 116, 58, 32, 48, 112, 120, 59, 32, 116, 111,
+    112, 58, 32, 48, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 48,
+    112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 48, 112, 120, 59,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32,
+    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
+    116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45,
+    98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102, 116, 58, 32, 48,
+    112, 120, 59, 32, 116, 111, 112, 58, 32, 48, 112, 120, 59, 32, 119, 105,
+    100, 116, 104, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116,
+    58, 32, 48, 112, 120, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
+    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
+    116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101,
+    110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 108, 101, 102, 116, 58,
+    32, 48, 112, 120, 59, 32, 116, 111, 112, 58, 32, 48, 112, 120, 59, 32,
+    119, 105, 100, 116, 104, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 48, 112, 120, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98,
+    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
+    110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 114, 101, 116, 117, 114, 110, 45, 116, 111, 45, 114, 101,
+    97, 108, 116, 105, 109, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 116,
+    117, 114, 110, 45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101, 45,
+    98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 110, 111, 110, 101, 59, 32, 125
+};
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
index 5dede20..11e6af2 100644
--- a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
+++ b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
@@ -31,6 +31,6 @@
 #define WebKitVersion_h
 
 #define WEBKIT_MAJOR_VERSION 532
-#define WEBKIT_MINOR_VERSION 1
+#define WEBKIT_MINOR_VERSION 3
 
 #endif //WebKitVersion_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
index daa7919..968f144 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
@@ -27,6 +27,7 @@
 #include "DNS.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderTypes.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
@@ -43,6 +44,7 @@ using namespace HTMLNames;
 HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document, CreateElement)
     , m_wasShiftKeyDownOnMouseDown(false)
+    , m_linkRelations(0)
 {
 }
 
@@ -67,7 +69,7 @@ bool HTMLAnchorElement::supportsFocus() const
 bool HTMLAnchorElement::isMouseFocusable() const
 {
     // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
-#if !PLATFORM(GTK)
+#if PLATFORM(MAC)
     if (isLink())
         return false;
 #endif
@@ -200,7 +202,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         }
 
         if (!evt->defaultPrevented() && document()->frame())
-            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true);
+            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true, hasRel(RelationNoReferrer) ? NoReferrer : SendReferrer);
 
         evt->setDefaultHandled();
     } else if (isLink() && isContentEditable()) {
@@ -274,10 +276,11 @@ void HTMLAnchorElement::parseMappedAttribute(MappedAttribute *attr)
             }
         }
     } else if (attr->name() == nameAttr ||
-             attr->name() == titleAttr ||
-             attr->name() == relAttr) {
+             attr->name() == titleAttr) {
         // Do nothing.
-    } else
+    } else if (attr->name() == relAttr)
+        setRel(attr->value());
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -321,6 +324,20 @@ void HTMLAnchorElement::setHref(const AtomicString& value)
     setAttribute(hrefAttr, value);
 }
 
+bool HTMLAnchorElement::hasRel(uint32_t relation) const
+{
+    return m_linkRelations & relation;
+}
+
+void HTMLAnchorElement::setRel(const String& value)
+{
+    m_linkRelations = 0;
+    ClassNames newLinkRelations(value, true);
+    // FIXME: Add link relations as they are implemented
+    if (newLinkRelations.contains("noreferrer"))
+        m_linkRelations |= RelationNoReferrer;
+}
+
 const AtomicString& HTMLAnchorElement::name() const
 {
     return getAttribute(nameAttr);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
index f538be2..e47ea99 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
@@ -28,6 +28,29 @@
 
 namespace WebCore {
 
+// Link relation bitmask values.
+// FIXME: Uncomment as the various link relations are implemented.
+enum {
+//     RelationAlternate   = 0x00000001,
+//     RelationArchives    = 0x00000002,
+//     RelationAuthor      = 0x00000004,
+//     RelationBoomark     = 0x00000008,
+//     RelationExternal    = 0x00000010,
+//     RelationFirst       = 0x00000020,
+//     RelationHelp        = 0x00000040,
+//     RelationIndex       = 0x00000080,
+//     RelationLast        = 0x00000100,
+//     RelationLicense     = 0x00000200,
+//     RelationNext        = 0x00000400,
+//     RelationNoFolow    = 0x00000800,
+    RelationNoReferrer     = 0x00001000,
+//     RelationPrev        = 0x00002000,
+//     RelationSearch      = 0x00004000,
+//     RelationSidebar     = 0x00008000,
+//     RelationTag         = 0x00010000,
+//     RelationUp          = 0x00020000,
+};
+
 class HTMLAnchorElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLAnchorElement> create(Document*);
@@ -51,6 +74,9 @@ public:
 
     bool isLiveLink() const;
 
+    bool hasRel(uint32_t relation) const;
+    void setRel(const String&);
+
 protected:
     HTMLAnchorElement(const QualifiedName&, Document*);
 
@@ -73,6 +99,7 @@ private:
 
     RefPtr<Element> m_rootEditableElementForSelectionOnMouseDown;
     bool m_wasShiftKeyDownOnMouseDown;
+    uint32_t m_linkRelations;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index 63a5c21..340779e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -125,6 +125,7 @@ object
 onabort
 onbeforecopy
 onbeforecut
+onbeforeload
 onbeforepaste
 onbeforeunload
 onblur
@@ -157,7 +158,6 @@ onkeyup
 onload
 onloadeddata
 onloadedmetadata
-onloadend
 onloadstart
 onmousedown
 onmousemove
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 9b2f70c..335b20f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -138,7 +138,7 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
         return String();
     }
 
-    if (m_size.isEmpty())
+    if (m_size.isEmpty() || !buffer())
         return String("data:,");
 
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType))
@@ -166,7 +166,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
     }
 #if ENABLE(3D_CANVAS)    
     Settings* settings = document()->settings();
-    if (settings && settings->experimentalWebGLEnabled()) {
+    if (settings && settings->webGLEnabled()) {
         if ((type == "webkit-3d") ||
             (type == "GL")) {
             if (m_context && !m_context->is3d())
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
index fd939c8..0d1cb19 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
@@ -307,8 +307,7 @@ PassRefPtr<Element> HTMLDocument::createElement(const AtomicString& name, Except
         ec = INVALID_CHARACTER_ERR;
         return 0;
     }
-    AtomicString lowerName = name.string().impl()->isLower() ? name : AtomicString(name.string().lower());
-    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, lowerName, xhtmlNamespaceURI), this, 0, false);
+    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, name.lower(), xhtmlNamespaceURI), this, 0, false);
 }
 
 static void addItemToMap(HashCountedSet<AtomicStringImpl*>& map, const AtomicString& name)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
index 967a8e0..df3cb7d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
@@ -67,7 +67,7 @@ String HTMLElement::nodeName() const
     // the string on a hit in the hash.
     // FIXME: We should have a way to detect XHTML elements and replace the hasPrefix() check with it.
     if (document()->isHTMLDocument() && !tagQName().hasPrefix())
-        return tagQName().localName().string().upper();
+        return tagQName().localNameUpper();
     return Element::nodeName();
 }
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index 8e66fe0..ea46980 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -41,6 +41,7 @@
 #include "RenderBox.h"
 #include "RenderTextControl.h"
 #include "RenderTheme.h"
+#include "ScriptEventListener.h"
 #include "ValidityState.h"
 
 namespace WebCore {
@@ -52,6 +53,7 @@ HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Doc
     , m_form(f)
     , m_disabled(false)
     , m_readOnly(false)
+    , m_required(false)
     , m_valueMatchesRenderer(false)
 {
     if (!m_form)
@@ -86,9 +88,9 @@ ValidityState* HTMLFormControlElement::validity()
 
 void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == nameAttr) {
-        // Do nothing.
-    } else if (attr->name() == disabledAttr) {
+    if (attr->name() == nameAttr)
+        setNeedsStyleRecalc();
+    else if (attr->name() == disabledAttr) {
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
@@ -104,6 +106,11 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
             if (renderer() && renderer()->style()->hasAppearance())
                 renderer()->theme()->stateChanged(renderer(), ReadOnlyState);
         }
+    } else if (attr->name() == requiredAttr) {
+        bool oldRequired = m_required;
+        m_required = !attr->isNull();
+        if (oldRequired != m_required)
+            setNeedsStyleRecalc();
     } else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -218,7 +225,7 @@ void HTMLFormControlElement::setAutofocus(bool b)
 
 bool HTMLFormControlElement::required() const
 {
-    return hasAttribute(requiredAttr);
+    return m_required;
 }
 
 void HTMLFormControlElement::setRequired(bool b)
@@ -291,6 +298,14 @@ bool HTMLFormControlElement::checkValidity()
     return true;
 }
 
+void HTMLFormControlElement::updateValidity()
+{
+    if (willValidate()) {
+        // Update style for pseudo classes such as :valid :invalid.
+        setNeedsStyleRecalc();
+    }
+}
+
 void HTMLFormControlElement::setCustomValidity(const String& error)
 {
     validity()->setCustomErrorMessage(error);
@@ -408,4 +423,81 @@ void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderVal
         toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
 }
 
+RenderTextControl* HTMLTextFormControlElement::textRendererAfterUpdateLayout()
+{
+    if (!isTextFormControl())
+        return 0;
+    document()->updateLayoutIgnorePendingStylesheets();
+    return toRenderTextControl(renderer());
+}
+
+void HTMLTextFormControlElement::setSelectionStart(int start)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionStart(start);
+}
+
+void HTMLTextFormControlElement::setSelectionEnd(int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionEnd(end);
+}
+
+void HTMLTextFormControlElement::select()
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->select();
+}
+
+void HTMLTextFormControlElement::setSelectionRange(int start, int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionRange(start, end);
+}
+
+int HTMLTextFormControlElement::selectionStart()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionStart() >= 0)
+        return cachedSelectionStart();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionStart();
+}
+
+int HTMLTextFormControlElement::selectionEnd()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionEnd() >= 0)
+        return cachedSelectionEnd();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionEnd();
+}
+
+VisibleSelection HTMLTextFormControlElement::selection() const
+{
+    if (!renderer() || !isTextFormControl() || cachedSelectionStart() < 0 || cachedSelectionEnd() < 0)
+        return VisibleSelection();
+    return toRenderTextControl(renderer())->selection(cachedSelectionStart(), cachedSelectionEnd());
+}
+
+void HTMLTextFormControlElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility(true);
+    else if (attr->name() == onfocusAttr)
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onblurAttr)
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onselectAttr)
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onchangeAttr)
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
+    else
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+}
+
 } // namespace Webcore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index 7b3cfbd..b5dc7ce 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -30,7 +30,9 @@ namespace WebCore {
 
 class FormDataList;
 class HTMLFormElement;
+class RenderTextControl;
 class ValidityState;
+class VisibleSelection;
 
 class HTMLFormControlElement : public HTMLElement {
 public:
@@ -106,10 +108,11 @@ public:
 
     virtual bool willValidate() const;
     bool checkValidity();
+    void updateValidity();
     void setCustomValidity(const String&);
-
     virtual bool valueMissing() const { return false; }
     virtual bool patternMismatch() const { return false; }
+    virtual bool tooLong() const { return false; }
 
     void formDestroyed() { m_form = 0; }
 
@@ -126,9 +129,10 @@ private:
 
     HTMLFormElement* m_form;
     RefPtr<ValidityState> m_validityState;
-    bool m_disabled;
-    bool m_readOnly;
-    bool m_valueMatchesRenderer;
+    bool m_disabled : 1;
+    bool m_readOnly : 1;
+    bool m_required : 1;
+    bool m_valueMatchesRenderer : 1;
 };
 
 class HTMLFormControlElementWithState : public HTMLFormControlElement {
@@ -150,9 +154,20 @@ public:
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
 
+    int selectionStart();
+    int selectionEnd();
+    void setSelectionStart(int);
+    void setSelectionEnd(int);
+    void select();
+    void setSelectionRange(int start, int end);
+    VisibleSelection selection() const;
+
 protected:
     bool placeholderShouldBeVisible() const;
     void updatePlaceholderVisibility(bool);
+    virtual int cachedSelectionStart() const = 0;
+    virtual int cachedSelectionEnd() const = 0;
+    virtual void parseMappedAttribute(MappedAttribute*);
 
 private:
     // A subclass should return true if placeholder processing is needed.
@@ -163,6 +178,7 @@ private:
     virtual void handleFocusEvent() { }
     // Called in dispatchBlurEvent(), after placeholder process, before calling parent's dispatchBlurEvent().
     virtual void handleBlurEvent() { }
+    RenderTextControl* textRendererAfterUpdateLayout();
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index 1bc4995..80df829 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -137,9 +137,11 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         m_viewSource = !attr->isNull();
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onbeforeunloadAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
         setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
     } else
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index 932e718..d353073 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -118,6 +118,8 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else if (attrName == compositeAttr) {
         if (!parseCompositeOperator(attr->value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
@@ -167,7 +169,7 @@ void HTMLImageElement::attach()
 {
     HTMLElement::attach();
 
-    if (renderer() && renderer()->isImage()) {
+    if (renderer() && renderer()->isImage() && m_imageLoader.haveFiredBeforeLoadEvent()) {
         RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index e6b8228..ed3405a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -196,6 +196,98 @@ bool HTMLInputElement::patternMismatch() const
     return false;
 }
 
+bool HTMLInputElement::tooLong() const
+{
+    switch (inputType()) {
+    case EMAIL:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case URL: {
+        int max = maxLength();
+        if (max < 0)
+            return false;
+        // Return false for the default value even if it is longer than maxLength.
+        bool userEdited = !m_data.value().isNull();
+        if (!userEdited)
+            return false;
+        return value().length() > static_cast<unsigned>(max);
+    }
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case NUMBER:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool HTMLInputElement::rangeUnderflow() const
+{
+    if (inputType() == NUMBER) {
+        double min = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
+            return doubleValue < min;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue < rangeMinimum();
+    }
+    return false;
+}
+
+bool HTMLInputElement::rangeOverflow() const
+{
+    if (inputType() == NUMBER) {
+        double max = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
+            return doubleValue > max;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue > rangeMaximum();
+    }
+    return false;
+}
+
+double HTMLInputElement::rangeMinimum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default minimum" is 0.
+    double min = 0.0;
+    formStringToDouble(getAttribute(minAttr), &min);
+    return min;
+}
+
+double HTMLInputElement::rangeMaximum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default maximum" is 100.
+    static const double defaultMaximum = 100.0;
+    double max = defaultMaximum;
+    formStringToDouble(getAttribute(maxAttr), &max);
+    const double min = rangeMinimum();
+
+    if (max < min) {
+        // A remedy for the inconsistent min/max values.
+        // Sets the maxmimum to the default (100.0) or the minimum value.
+        max = min < defaultMaximum ? defaultMaximum : min;
+    }
+    return max;
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -382,6 +474,7 @@ void HTMLInputElement::setInputType(const String& t)
         }
 
         InputElement::notifyFormStateChanged(this);
+        updateValidity();
     }
     m_haveType = true;
 
@@ -543,63 +636,6 @@ bool HTMLInputElement::canHaveSelection() const
     return isTextField();
 }
 
-int HTMLInputElement::selectionStart() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionStart() != -1)
-        return m_data.cachedSelectionStart();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLInputElement::selectionEnd() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionEnd() != -1)
-        return m_data.cachedSelectionEnd();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static bool isTextFieldWithRenderer(HTMLInputElement* element)
-{
-    if (!element->isTextField())
-        return false;
-
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    if (!element->renderer())
-        return false;
-
-    return true;
-}
-
-void HTMLInputElement::setSelectionStart(int start)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionStart(start);
-}
-
-void HTMLInputElement::setSelectionEnd(int end)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionEnd(end);
-}
-
-void HTMLInputElement::select()
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->select();
-}
-
-void HTMLInputElement::setSelectionRange(int start, int end)
-{
-    InputElement::updateSelectionRange(this, this, start, end);
-}
-
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
 {
     switch (inputType()) {
@@ -659,6 +695,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         checkedRadioButtons(this).removeButton(this);
         m_data.setName(attr->value());
         checkedRadioButtons(this).addButton(this);
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
             m_autocomplete = Off;
@@ -678,12 +715,14 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (m_data.value().isNull())
             setNeedsStyleRecalc();
         setFormControlValueMatchesRenderer(false);
+        updateValidity();
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
+        updateValidity();
     } else if (attr->name() == maxlengthAttr)
         InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
     else if (attr->name() == sizeAttr)
@@ -715,14 +754,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == heightAttr) {
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onselectAttr) {
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onchangeAttr) {
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
@@ -730,7 +761,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
-        m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
+        m_maxResults = !attr->isNull() ? std::min(attr->value().toInt(), maxSavedResults) : -1;
         // FIXME: Detaching just for maxResults change is not ideal.  We should figure out the right
         // time to relayout for this change.
         if (m_maxResults != oldResults && (m_maxResults <= 0 || oldResults <= 0) && attached()) {
@@ -738,8 +769,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             attach();
         }
         setNeedsStyleRecalc();
-    } else if (attr->name() == placeholderAttr) {
-        updatePlaceholderVisibility(true);
     } else if (attr->name() == autosaveAttr ||
              attr->name() == incrementalAttr ||
              attr->name() == minAttr ||
@@ -747,13 +776,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
              attr->name() == multipleAttr ||
              attr->name() == precisionAttr)
         setNeedsStyleRecalc();
+    else if (attr->name() == patternAttr)
+        updateValidity();
 #if ENABLE(DATALIST)
     else if (attr->name() == listAttr)
         m_hasNonEmptyList = !attr->isEmpty();
         // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
 #endif
     else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
@@ -831,7 +862,7 @@ void HTMLInputElement::attach()
         if (!m_imageLoader)
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
-        if (renderer()) {
+        if (renderer() && m_imageLoader->haveFiredBeforeLoadEvent()) {
             RenderImage* imageObj = toRenderImage(renderer());
             imageObj->setCachedImage(m_imageLoader->image()); 
             
@@ -1127,6 +1158,7 @@ void HTMLInputElement::setValue(const String& value)
             cacheSelection(max, max);
     }
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLInputElement::placeholder() const
@@ -1150,6 +1182,7 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
     ASSERT(inputType() != FILE);
     updatePlaceholderVisibility(false);
     InputElement::setValueFromRenderer(m_data, this, this, value);
+    updateValidity();
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1161,6 +1194,7 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
 
     setFormControlValueMatchesRenderer(true);
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1610,12 +1644,12 @@ int HTMLInputElement::maxLength() const
     return m_data.maxLength();
 }
 
-void HTMLInputElement::setMaxLength(int _maxLength, ExceptionCode& exceptionCode)
+void HTMLInputElement::setMaxLength(int maxLength, ExceptionCode& ec)
 {
-    if (_maxLength < 0)
-        exceptionCode = INDEX_SIZE_ERR;
+    if (maxLength < 0)
+        ec = INDEX_SIZE_ERR;
     else
-        setAttribute(maxlengthAttr, String::number(_maxLength));
+        setAttribute(maxlengthAttr, String::number(maxLength));
 }
 
 bool HTMLInputElement::multiple() const
@@ -1746,13 +1780,6 @@ void HTMLInputElement::onSearch()
     dispatchEvent(Event::create(eventNames().searchEvent, true, false));
 }
 
-VisibleSelection HTMLInputElement::selection() const
-{
-    if (!renderer() || !isTextField() || m_data.cachedSelectionStart() == -1 || m_data.cachedSelectionEnd() == -1)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_data.cachedSelectionStart(), m_data.cachedSelectionEnd());
-}
-
 void HTMLInputElement::documentDidBecomeActive()
 {
     ASSERT(needsActivationCallback());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 16e3b58..799d92c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -93,6 +93,15 @@ public:
 
     virtual bool valueMissing() const;
     virtual bool patternMismatch() const;
+    virtual bool tooLong() const;
+    // For ValidityState
+    bool rangeUnderflow() const;
+    bool rangeOverflow() const;
+    // Returns the minimum value for type=range.  Don't call this for other types.
+    double rangeMinimum() const;
+    // Returns the maximum value for type=range.  Don't call this for other types.
+    // This always returns a value which is <= rangeMinimum().
+    double rangeMaximum() const;
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
@@ -128,12 +137,7 @@ public:
     virtual bool canStartSelection() const;
     
     bool canHaveSelection() const;
-    int selectionStart() const;
-    int selectionEnd() const;
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-    virtual void select();
-    void setSelectionRange(int start, int end);
+    virtual void select() { HTMLTextFormControlElement::select(); }
 
     virtual void accessKeyAction(bool sendToAnyElement);
 
@@ -218,8 +222,6 @@ public:
     void addSearchResult();
     void onSearch();
 
-    VisibleSelection selection() const;
-
     virtual String sanitizeValue(const String&) const;
 
     virtual void documentDidBecomeActive();
@@ -248,6 +250,8 @@ private:
     virtual bool isEmptyValue() const { return value().isEmpty(); }
     virtual void handleFocusEvent();
     virtual void handleBlurEvent();
+    virtual int cachedSelectionStart() const { return m_data.cachedSelectionStart(); }
+    virtual int cachedSelectionEnd() const { return m_data.cachedSelectionEnd(); }
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
index 7cdf487..59248f4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
@@ -42,8 +42,14 @@ module html {
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLElement     list;
 #endif
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString max;
+#endif
                  attribute long            maxLength
                      setter raises(DOMException);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString min;
+#endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [Reflect] DOMString       pattern;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 0971ef5..6b74221 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -38,6 +38,7 @@
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -126,7 +127,9 @@ void HTMLLinkElement::parseMappedAttribute(MappedAttribute *attr)
         process();
     } else if (attr->name() == disabledAttr) {
         setDisabledState(!attr->isNull());
-    } else {
+    } else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else {
         if (attr->name() == titleAttr && m_sheet)
             m_sheet->setTitle(attr->value());
         HTMLElement::parseMappedAttribute(attr);
@@ -187,11 +190,7 @@ void HTMLLinkElement::process()
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
     if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
-        // Add ourselves as a pending sheet, but only if we aren't an alternate 
-        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-        if (!isAlternate())
-            document()->addPendingSheet();
-
+        
         String charset = getAttribute(charsetAttr);
         if (charset.isEmpty() && document()->frame())
             charset = document()->frame()->loader()->encoding();
@@ -200,14 +199,28 @@ void HTMLLinkElement::process()
             if (m_loading)
                 document()->removePendingSheet();
             m_cachedSheet->removeClient(this);
+            m_cachedSheet = 0;
         }
+
+        if (!dispatchBeforeLoadEvent(m_url))
+            return;
+        
         m_loading = true;
+        
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
+
         m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        
         if (m_cachedSheet)
             m_cachedSheet->addClient(this);
-        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+        else {
+            // The request may have been denied if (for example) the stylesheet is local and the document is remote.
             m_loading = false;
-            document()->removePendingSheet();
+            if (!isAlternate())
+                document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
@@ -261,7 +274,7 @@ void HTMLLinkElement::setCSSStyleSheet(const String& url, const String& charset,
         DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
         // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
         // while the other lacks the second trailing newline.
-        if (url.endsWith(slashKHTMLFixesDotCss) && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+        if (url.endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
                 && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
             ASSERT(m_sheet->length() == 1);
             ExceptionCode ec;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 2409d37..11ca3ba 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -28,6 +28,9 @@
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 
+#include "ClientRect.h"
+#include "ClientRectList.h"
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -39,6 +42,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
+#include "FrameView.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
@@ -53,6 +57,7 @@
 #include "Page.h"
 #include "ProgressEvent.h"
 #include "RenderVideo.h"
+#include "RenderView.h"
 #include "ScriptEventListener.h"
 #include "TimeRanges.h"
 #include <limits>
@@ -111,6 +116,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_sentEndEvent(false)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
+    , m_isFullscreen(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -161,6 +167,8 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
             m_player->setAutobuffer(!attr->isNull());
     } else if (attrName == onabortAttr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else if (attrName == oncanplayAttr)
         setAttributeEventListener(eventNames().canplayEvent, createAttributeEventListener(this, attr));
     else if (attrName == oncanplaythroughAttr)
@@ -179,8 +187,6 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadedmetadataAttr)
         setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onloadendAttr)
-        setAttributeEventListener(eventNames().loadendEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadstartAttr)
         setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
     else if (attrName == onpauseAttr)
@@ -241,6 +247,12 @@ void HTMLMediaElement::insertedIntoDocument()
         scheduleLoad();
 }
 
+void HTMLMediaElement::willRemove()
+{
+    if (m_isFullscreen)
+        exitFullscreen();
+    HTMLElement::willRemove();
+}
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
@@ -454,17 +466,15 @@ void HTMLMediaElement::loadInternal()
     // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
     // the error attribute to a new MediaError object whose code attribute is set to
     // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
-    // context of the fetching process that is in progress for the element, and fire a progress
-    // event called loadend at the media element, in the context of the same fetching process.
+    // context of the fetching process that is in progress for the element.
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
-        // fire synchronous 'abort' and 'loadend'
+        // fire synchronous 'abort'
         bool totalKnown = m_player && m_player->totalBytesKnown();
         unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
         unsigned total = m_player ? m_player->totalBytes() : 0;
         dispatchEvent(ProgressEvent::create(eventNames().abortEvent, totalKnown, loaded, total));
-        dispatchEvent(ProgressEvent::create(eventNames().loadendEvent, totalKnown, loaded, total));
     }
 
     // 5
@@ -496,35 +506,34 @@ void HTMLMediaElement::loadInternal()
 
 void HTMLMediaElement::selectMediaResource()
 {
-    // 1 - If the media element has neither a src attribute nor any source element children, run these substeps
+    // 1 - Set the networkState to NETWORK_NO_SOURCE
+    m_networkState = NETWORK_NO_SOURCE;
+
+    // 2 - Asynchronously await a stable state.
+
+    // 3 - If the media element has neither a src attribute nor any source element children, run these substeps
     String mediaSrc = getAttribute(srcAttr);
     if (!mediaSrc && !havePotentialSourceChild()) {
         m_loadState = WaitingForSource;
 
-        // 1 -  Set the networkState to NETWORK_NO_SOURCE
-        m_networkState = NETWORK_NO_SOURCE;
-        
-        // 2 - While the media element has neither a src attribute nor any source element children, 
-        // wait. (This steps might wait forever.)
-
-        m_delayingTheLoadEvent = false;
+        // 1 - Set the networkState to NETWORK_EMPTY and abort these steps
+        m_networkState = NETWORK_EMPTY;
+        ASSERT(!m_delayingTheLoadEvent);
         return;
     }
 
-    // 2
+    // 4
     m_delayingTheLoadEvent = true;
-
-    // 3
     m_networkState = NETWORK_LOADING;
 
-    // 4
+    // 5
     scheduleProgressEvent(eventNames().loadstartEvent);
 
-    // 5 - If the media element has a src attribute, then run these substeps
+    // 6 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
-    if (!mediaSrc.isEmpty()) {
+    if (!mediaSrc.isNull()) {
         KURL mediaURL = document()->completeURL(mediaSrc);
-        if (isSafeToLoadURL(mediaURL, Complain)) {
+        if (isSafeToLoadURL(mediaURL, Complain) && dispatchBeforeLoadEvent(mediaURL.string())) {
             m_loadState = LoadingFromSrcAttr;
             loadResource(mediaURL, contentType);
         } else 
@@ -553,9 +562,20 @@ void HTMLMediaElement::loadNextSourceChild()
     loadResource(mediaURL, contentType);
 }
 
-void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
+void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& contentType)
 {
-    ASSERT(isSafeToLoadURL(url, Complain));
+    ASSERT(isSafeToLoadURL(initialURL, Complain));
+
+    Frame* frame = document()->frame();
+    if (!frame)
+        return;
+    FrameLoader* loader = frame->loader();
+    if (!loader)
+        return;
+
+    KURL url(initialURL);
+    if (!loader->willLoadMediaElementURL(url))
+        return;
 
     // The resource fetch algorithm 
     m_networkState = NETWORK_LOADING;
@@ -577,7 +597,13 @@ void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
     updateVolume();
 
     m_player->load(m_currentSrc, contentType);
-    
+
+    if (isVideo() && m_player->canLoadPoster()) {
+        KURL posterUrl = static_cast<HTMLVideoElement*>(this)->poster();
+        if (!posterUrl.isEmpty())
+            m_player->setPoster(posterUrl);
+    }
+
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -588,7 +614,7 @@ bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction acti
     FrameLoader* loader = frame ? frame->loader() : 0;
 
     // don't allow remote to local urls, and check with the frame loader client.
-    if (!loader || !loader->canLoad(url, String(), document()) || !loader->client()->shouldLoadMediaElementURL(url)) {
+    if (!loader || !SecurityOrigin::canLoad(url, String(), document())) {
         if (actionIfInvalid == Complain)
             FrameLoader::reportLocalLoadFailed(frame, url.string());
         return false;
@@ -614,24 +640,19 @@ void HTMLMediaElement::noneSupported()
     m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
-    // 4 - Reaching this step indicates that either the URL failed to resolve, or the media
+    // 5 - Reaching this step indicates that either the URL failed to resolve, or the media
     // resource failed to load. Set the error attribute to a new MediaError object whose
     // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
-    // 5 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    // 6 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
 
-    // 6 - Queue a task to fire a progress event called error at the media element, in
+    // 7 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process that was used to try to obtain the media
     // resource in the resource fetch algorithm.
     scheduleProgressEvent(eventNames().errorEvent);
 
-    // 7 - Queue a task to fire a progress event called loadend at the media element, in
-    // the context of the fetching process that was used to try to obtain the media
-    // resource in the resource fetch algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
@@ -657,19 +678,15 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     // the context of the fetching process started by this instance of this algorithm.
     scheduleProgressEvent(eventNames().errorEvent);
 
-    // 4 - Queue a task to fire a progress event called loadend at the media element, in
-    // the context of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
-    // 5 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
+    // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
     m_networkState = NETWORK_EMPTY;
     scheduleEvent(eventNames().emptiedEvent);
 
-    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // 7 - Abort the overall resource selection algorithm.
+    // 6 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
 }
 
@@ -756,7 +773,6 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
                 setReadyState(currentState);
 
             scheduleProgressEvent(eventNames().loadEvent);
-            scheduleProgressEvent(eventNames().loadendEvent);
         }
     }
 }
@@ -1355,7 +1371,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSo
 
         // Is it safe to load this url?
         mediaURL = source->src();
-        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid))
+        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid) || !dispatchBeforeLoadEvent(mediaURL.string()))
             goto check_again;
 
         // Making it this far means the <source> looks reasonable
@@ -1514,7 +1530,12 @@ PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
 
 bool HTMLMediaElement::potentiallyPlaying() const
 {
-    return !paused() && m_readyState >= HAVE_FUTURE_DATA && !endedPlayback() && !stoppedDueToErrors() && !pausedForUserInteraction();
+    return m_readyState >= HAVE_FUTURE_DATA && couldPlayIfEnoughData();
+}
+
+bool HTMLMediaElement::couldPlayIfEnoughData() const
+{
+    return !paused() && !endedPlayback() && !stoppedDueToErrors() && !pausedForUserInteraction();
 }
 
 bool HTMLMediaElement::endedPlayback() const
@@ -1598,7 +1619,8 @@ void HTMLMediaElement::updatePlayState()
         float time = currentTime();
         if (time > m_lastSeekTime)
             addPlayedRange(m_lastSeekTime, time);
-    }
+    } else if (couldPlayIfEnoughData() && playerPaused)
+        m_player->prepareToPlay();
     
     if (renderer())
         renderer()->updateFromElement();
@@ -1629,17 +1651,13 @@ void HTMLMediaElement::userCancelledLoad()
 #endif
     stopPeriodicTimers();
 
-    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
     // 3 - Queue a task to fire a progress event called abort at the media element, in the context
     // of the fetching process started by this instance of this algorithm.
     scheduleProgressEvent(eventNames().abortEvent);
 
-    // 4 - Queue a task to fire a progress event called loadend at the media element, in the context
-    // of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
     // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
     // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
     // simple event called emptied at the element. Otherwise, set set the element's networkState
@@ -1696,6 +1714,14 @@ void HTMLMediaElement::mediaVolumeDidChange()
     updateVolume();
 }
 
+const IntRect HTMLMediaElement::screenRect()
+{
+    IntRect elementRect;
+    if (renderer())
+        elementRect = renderer()->view()->frameView()->contentsToScreen(renderer()->absoluteBoundingBoxRect());
+    return elementRect;
+}
+    
 void HTMLMediaElement::defaultEventHandler(Event* event)
 {
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -1768,6 +1794,28 @@ void HTMLMediaElement::finishParsingChildren()
 
 #endif
 
+void HTMLMediaElement::enterFullscreen()
+{
+    ASSERT(!m_isFullscreen);
+    if (!renderer())
+        return;
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->enterFullscreenForNode(this);
+    m_isFullscreen = true;
+}
+
+void HTMLMediaElement::exitFullscreen()
+{
+    ASSERT(m_isFullscreen);
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->exitFullscreenForNode(this);
+    m_isFullscreen = false;
+}
+
+PlatformMedia HTMLMediaElement::platformMedia() const
+{
+    return m_player ? m_player->platformMedia() : NoPlatformMedia;
+}        
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index aa8d5f7..0005e07 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -43,7 +43,7 @@ class HTMLSourceElement;
 class MediaError;
 class KURL;
 class TimeRanges;
-    
+
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
 public:
     HTMLMediaElement(const QualifiedName&, Document*);
@@ -57,6 +57,7 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
+    virtual void willRemove();
     virtual void removedFromDocument();
     virtual void attach();
     virtual void recalcStyle(StyleChange);
@@ -73,6 +74,8 @@ public:
     // Eventually overloaded in HTMLVideoElement
     virtual bool supportsFullscreen() const { return false; };
     virtual bool supportsSave() const;
+    
+    PlatformMedia platformMedia() const;
 
     void scheduleLoad();
     
@@ -141,6 +144,8 @@ public:
     void beginScrubbing();
     void endScrubbing();
 
+    const IntRect screenRect();
+
     bool canPlay() const;
 
     float percentLoaded() const;
@@ -154,6 +159,9 @@ public:
 #endif
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
+    
+    void enterFullscreen();
+    void exitFullscreen();
 
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
@@ -233,6 +241,7 @@ private:
     bool endedPlayback() const;
     bool stoppedDueToErrors() const;
     bool pausedForUserInteraction() const;
+    bool couldPlayIfEnoughData() const;
 
     float minTimeSeekable() const;
     float maxTimeSeekable() const;
@@ -310,6 +319,8 @@ protected:
     // support progress events so setting m_sendProgressEvents disables them 
     bool m_sendProgressEvents : 1;
 
+    bool m_isFullscreen : 1;
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
index 9765c43..d3ccfa4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
@@ -95,9 +95,11 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
         m_classId = val;
         if (renderer())
           m_needWidgetUpdate = true;
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == nameAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
index ce7fee6..636c579 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
@@ -71,6 +71,8 @@ void HTMLScriptElement::parseMappedAttribute(MappedAttribute* attr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -217,7 +219,7 @@ String HTMLScriptElement::forAttributeValue() const
 {
     return getAttribute(forAttr).string();
 }
- 
+
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index b5e4ced..3030018 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -70,6 +70,7 @@ HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document*
     , m_wrap(SoftWrap)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
+    , m_isDirty(false)
 {
     ASSERT(hasTagName(textareaTag));
     setFormControlValueMatchesRenderer(true);
@@ -93,54 +94,6 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
     setDefaultValue(state);
 }
 
-int HTMLTextAreaElement::selectionStart()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionStart >= 0)
-        return m_cachedSelectionStart;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLTextAreaElement::selectionEnd()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionEnd >= 0)
-        return m_cachedSelectionEnd;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static RenderTextControl* rendererAfterUpdateLayout(HTMLTextAreaElement* element)
-{
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    return toRenderTextControl(element->renderer());
-}
-
-void HTMLTextAreaElement::setSelectionStart(int start)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionStart(start);
-}
-
-void HTMLTextAreaElement::setSelectionEnd(int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionEnd(end);
-}
-
-void HTMLTextAreaElement::select()
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->select();
-}
-
-void HTMLTextAreaElement::setSelectionRange(int start, int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionRange(start, end);
-}
-
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     setValue(defaultValue());
@@ -196,18 +149,8 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
-    } else if (attr->name() == placeholderAttr) {
-        updatePlaceholderVisibility(true);
-    } else if (attr->name() == onfocusAttr)
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onblurAttr)
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onselectAttr)
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onchangeAttr)
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
-    else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+    } else
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -231,6 +174,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 void HTMLTextAreaElement::reset()
 {
     setValue(defaultValue());
+    m_isDirty = false;
 }
 
 bool HTMLTextAreaElement::isKeyboardFocusable(KeyboardEvent*) const
@@ -316,6 +260,7 @@ void HTMLTextAreaElement::updateValue() const
     m_value = toRenderTextControl(renderer())->text();
     const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
+    m_isDirty = true;
 }
 
 String HTMLTextAreaElement::value() const
@@ -353,6 +298,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     setNeedsStyleRecalc();
     notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLTextAreaElement::defaultValue() const
@@ -409,14 +355,26 @@ int HTMLTextAreaElement::maxLength() const
     return ok && value >= 0 ? value : -1;
 }
 
-void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& exceptionCode)
+void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& ec)
 {
     if (newValue < 0)
-        exceptionCode = INDEX_SIZE_ERR;
+        ec = INDEX_SIZE_ERR;
     else
         setAttribute(maxlengthAttr, String::number(newValue));
 }
 
+bool HTMLTextAreaElement::tooLong() const
+{
+    // Return false for the default value even if it is longer than maxLength.
+    if (!m_isDirty)
+        return false;
+
+    int max = maxLength();
+    if (max < 0)
+        return false;
+    return value().length() > static_cast<unsigned>(max);
+}
+
 void HTMLTextAreaElement::accessKeyAction(bool)
 {
     focus();
@@ -442,13 +400,6 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
-VisibleSelection HTMLTextAreaElement::selection() const
-{
-    if (!renderer() || m_cachedSelectionStart < 0 || m_cachedSelectionEnd < 0)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
-}
-
 bool HTMLTextAreaElement::shouldUseInputMethod() const
 {
     return true;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index cfd471a..23f61d3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -55,15 +55,6 @@ public:
 
     virtual bool valueMissing() const { return isRequiredFormControl() && !disabled() && !readOnly() && value().isEmpty(); }
 
-    int selectionStart();
-    int selectionEnd();
-
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-
-    void select();
-    void setSelectionRange(int, int);
-
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -81,6 +72,7 @@ public:
     int textLength() const { return value().length(); }
     int maxLength() const;
     void setMaxLength(int, ExceptionCode&);
+    virtual bool tooLong() const;
     
     void rendererWillBeDestroyed();
     
@@ -93,7 +85,6 @@ public:
     void setRows(int);
     
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
-    VisibleSelection selection() const;
 
     virtual bool shouldUseInputMethod() const;
 
@@ -106,6 +97,8 @@ private:
 
     virtual bool supportsPlaceholder() const { return true; }
     virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual int cachedSelectionStart() const { return m_cachedSelectionStart; }
+    virtual int cachedSelectionEnd() const { return m_cachedSelectionEnd; }
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const { return required(); }
@@ -116,6 +109,7 @@ private:
     mutable String m_value;
     int m_cachedSelectionStart;
     int m_cachedSelectionEnd;
+    mutable bool m_isDirty;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index fa68151..33af997 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -43,6 +43,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "ImageLoader.h"
 #include "InspectorTimelineAgent.h"
 #include "MappedAttribute.h"
 #include "Page.h"
@@ -441,7 +442,8 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 #endif
                 // The parser might have been stopped by for example a window.close call in an earlier script.
                 // If so, we don't want to load scripts.
-                if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
+                if (!m_parserStopped && m_scriptNode->dispatchBeforeLoadEvent(m_scriptTagSrcAttrValue) &&
+                    (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
                     m_pendingScripts.append(cs);
                 else
                     m_scriptNode = 0;
@@ -560,7 +562,7 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
 #endif
 
     m_state = state;
-    m_doc->frame()->loader()->executeScript(sourceCode);
+    m_doc->frame()->script()->executeScript(sourceCode);
     state = m_state;
 
     state.setAllowYield(true);
@@ -1673,7 +1675,7 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     State state = m_state;
 
-    while (!m_src.isEmpty() && (!frame || !frame->loader()->isScheduledLocationChangePending())) {
+    while (!m_src.isEmpty() && (!frame || !frame->redirectScheduler()->locationChangePending())) {
         if (!continueProcessing(processedCount, startTime, state))
             break;
 
@@ -1801,6 +1803,9 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
+    
+    // After parsing, go ahead and dispatch image beforeload/load events.
+    ImageLoader::dispatchPendingEvents();
 }
 
 void HTMLTokenizer::stopParsing()
@@ -1981,6 +1986,14 @@ void HTMLTokenizer::enlargeScriptBuffer(int len)
         CRASH();
 
     int newSize = m_scriptCodeCapacity + delta;
+    // If we allow fastRealloc(ptr, 0), it will call CRASH(). We run into this
+    // case if the HTML being parsed begins with "<!--" and there's more data
+    // coming.
+    if (!newSize) {
+        ASSERT(!m_scriptCode);
+        return;
+    }
+
     m_scriptCode = static_cast<UChar*>(fastRealloc(m_scriptCode, newSize * sizeof(UChar)));
     m_scriptCodeCapacity = newSize;
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
index ecd74e7..5bbc167 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLVideoElement.h"
 
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -112,6 +113,18 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
         HTMLMediaElement::parseMappedAttribute(attr);
 }
 
+bool HTMLVideoElement::supportsFullscreen() const
+{
+    Page* page = document() ? document()->page() : 0;
+    if (!page) 
+        return false;
+
+    if (!m_player || !m_player->supportsFullscreen())
+        return false;
+    
+    return page->chrome()->client()->supportsFullscreenForNode(this);
+}
+
 unsigned HTMLVideoElement::videoWidth() const
 {
     if (!m_player)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index dc9714a..096eb53 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -49,7 +49,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
-    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
+    virtual bool supportsFullscreen() const;
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
index df8933d..6b0a0b4 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
@@ -26,6 +26,12 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "RegularExpression.h"
+#include <wtf/StdLibExtras.h>
+
+#define EMAIL_LOCALPART "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+"
+#define EMAIL_DOMAINPART "[a-z0-9-]+(\\.[a-z0-9-]+)+"
+#define EMAIL_PATTERN EMAIL_LOCALPART "@" EMAIL_DOMAINPART
 
 namespace WebCore {
 
@@ -55,11 +61,38 @@ bool ValidityState::typeMismatch()
         return !HTMLInputElement::formStringToDouble(value, 0);
     case HTMLInputElement::URL:
         return !KURL(KURL(), value).isValid();
+    case HTMLInputElement::EMAIL:
+    {
+        if (!input->multiple())
+            return !isValidEmailAddress(value);
+            
+        Vector<String> email_list;
+        value.split(',', email_list);
+        for (unsigned i = 0; i < email_list.size(); ++i)
+            if (!isValidEmailAddress(email_list[i]))
+                return true;
+
+        return false;
+    }
     default:
         return false;
     }
 }
 
+bool ValidityState::rangeUnderflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeUnderflow();
+}
+
+bool ValidityState::rangeOverflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeOverflow();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
@@ -81,4 +114,19 @@ bool ValidityState::isValidColorString(const String& value)
     return color.isValid() && !color.hasAlpha();
 }
 
+bool ValidityState::isValidEmailAddress(const String& email)
+{
+    if (email.isEmpty())
+        return false;
+
+    DEFINE_STATIC_LOCAL(AtomicString, emailPattern, (EMAIL_PATTERN));
+    DEFINE_STATIC_LOCAL(RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
+
+    int matchLength = 0;
+    int emailLength = email.length();
+    int matchOffset = regExp.match(email, 0, &matchLength);
+
+    return matchOffset == 0 && matchLength == emailLength;
+}
+
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.h b/src/3rdparty/webkit/WebCore/html/ValidityState.h
index 1b87f99..1dee306 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.h
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.h
@@ -43,9 +43,9 @@ namespace WebCore {
         bool valueMissing() { return control()->valueMissing(); }
         bool typeMismatch();
         bool patternMismatch() { return control()->patternMismatch(); }
-        bool tooLong() { return false; }
-        bool rangeUnderflow() { return false; }
-        bool rangeOverflow() { return false; }
+        bool tooLong() { return control()->tooLong(); }
+        bool rangeUnderflow();
+        bool rangeOverflow();
         bool stepMismatch() { return false; }
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
@@ -56,6 +56,7 @@ namespace WebCore {
         String m_customErrorMessage;
 
         static bool isValidColorString(const String&);
+        bool isValidEmailAddress(const String&);
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h
new file mode 100644
index 0000000..b04b0d0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasActiveInfo_h
+#define CanvasActiveInfo_h
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class CanvasActiveInfo : public RefCounted<CanvasActiveInfo> {
+public:
+    static PassRefPtr<CanvasActiveInfo> create(const String& name, unsigned type, int size)
+    {
+        return adoptRef(new CanvasActiveInfo(name, type, size));
+    }
+    String name() const { return m_name; }
+    unsigned type() const { return m_type; }
+    int size() const { return m_size; }
+
+private:
+    CanvasActiveInfo(const String& name, unsigned type, int size)
+        : m_name(name)
+        , m_type(type)
+        , m_size(size)
+    {
+        ASSERT(name.length());
+        ASSERT(type);
+        ASSERT(size);
+    }
+    String m_name;
+    unsigned m_type;
+    int m_size;
+};
+
+}
+
+#endif // CanvasActiveInfo_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl
new file mode 100644
index 0000000..6ceae29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasActiveInfo.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        Conditional=3D_CANVAS,
+    ] CanvasActiveInfo {
+        readonly attribute int size;
+        readonly attribute unsigned int type;
+        readonly attribute DOMString name;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
index 37cc840..6b5688a 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
@@ -36,7 +36,7 @@ namespace WebCore {
         : m_offset(offset)
         , m_buffer(buffer)
     {
-        m_baseAddress = static_cast<char*>(m_buffer->data()) + m_offset;
+        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
     }
 
     CanvasArray::~CanvasArray()
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
index e34ad8c..8cedbbe 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
@@ -34,6 +34,14 @@
 namespace WebCore {
     class CanvasArray : public RefCounted<CanvasArray> {
     public:
+        virtual bool isByteArray() const { return false; }
+        virtual bool isUnsignedByteArray() const { return false; }
+        virtual bool isShortArray() const { return false; }
+        virtual bool isUnsignedShortArray() const { return false; }
+        virtual bool isIntArray() const { return false; }
+        virtual bool isUnsignedIntArray() const { return false; }
+        virtual bool isFloatArray() const { return false; }
+        
         PassRefPtr<CanvasArrayBuffer> buffer() {
             return m_buffer;
         }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
index 01bb37e..63b2dcd 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasArray {
+    interface [Conditional=3D_CANVAS, CustomToJS] CanvasArray {
         readonly attribute long length;
         int sizeInBytes();
         int alignedSizeInBytes();
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
index 8375334..0f72ccf 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
@@ -48,12 +48,13 @@ PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned
 
 PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
 {
-    // Check to make sure we are talking about a valid region of
-    // the given CanvasArrayBuffer's storage.
-    if ((offset + (length * sizeof(signed char))) > buffer->byteLength()) {
-        return NULL;
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
+            return NULL;
     }
-
+    
     return adoptRef(new CanvasByteArray(buffer, offset, length));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
index 34ae292..69cadf7 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
@@ -27,6 +27,7 @@
 #define CanvasByteArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -37,6 +38,8 @@ namespace WebCore {
 
     class CanvasByteArray : public CanvasArray {
     public:
+        virtual bool isByteArray() const { return true; }
+
         static PassRefPtr<CanvasByteArray> create(unsigned length);
         static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
         static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
index c78be1a..09561cb 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
@@ -48,16 +48,15 @@ namespace WebCore {
     PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
     {
         // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(float)) != 0) {
+        if ((offset % sizeof(float)) != 0)
             return NULL;
-        }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(float))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(float))) > buffer->byteLength())
+                return NULL;
         }
-
         return adoptRef(new CanvasFloatArray(buffer, offset, length));
     }
     
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
index 49bd897..d2dc4ff 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
@@ -35,6 +35,8 @@ namespace WebCore {
     
     class CanvasFloatArray : public CanvasArray {
     public:
+        virtual bool isFloatArray() const { return true; }
+
         static PassRefPtr<CanvasFloatArray> create(unsigned length);
         static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
         static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
index 9a07b6e..4716d7b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
@@ -51,16 +51,16 @@ namespace WebCore {
                                                       unsigned length)
     {
         // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(int)) != 0) {
+        if ((offset % sizeof(int)) != 0)
             return NULL;
-        }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(int))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(int))) > buffer->byteLength())
+                return NULL;
         }
-
+        
         return adoptRef(new CanvasIntArray(buffer, offset, length));
     }
     
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
index ace6410..4977034 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
@@ -27,6 +27,7 @@
 #define CanvasIntArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasIntArray : public CanvasArray {
     public:
+        virtual bool isIntArray() const { return true; }
+
         static PassRefPtr<CanvasIntArray> create(unsigned length);
         static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
         static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
index 413da71..748278d 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
@@ -48,12 +48,12 @@ namespace WebCore {
             deleteObject();
             m_context = 0;
         }
-        
+
+        CanvasRenderingContext3D* context() const { return m_context; }
+
     protected:
         CanvasObject(CanvasRenderingContext3D*);
         virtual void _deleteObject(Platform3DObject) = 0;
-        
-        CanvasRenderingContext3D* context() const { return m_context; }
     
     private:
         Platform3DObject m_object;
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index ed462fc..5e25b93 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -687,7 +687,7 @@ void CanvasRenderingContext2D::clip()
         return;
     if (!state().m_invertibleCTM)
         return;
-    c->clip(m_path);
+    c->canvasClip(m_path);
 #if ENABLE(DASHBOARD_SUPPORT)
     clearPathForDashboardBackwardCompatibilityMode();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
index b810500..9cca57b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -28,6 +28,8 @@
 #if ENABLE(3D_CANVAS)
 
 #include "CanvasRenderingContext3D.h"
+
+#include "CanvasActiveInfo.h"
 #include "CanvasBuffer.h"
 #include "CanvasFramebuffer.h"
 #include "CanvasProgram.h"
@@ -477,6 +479,26 @@ void CanvasRenderingContext3D::generateMipmap(unsigned long target)
     cleanupAfterGraphicsCall(false);
 }
 
+PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    ActiveInfo info;
+    if (!program || program->context() != this || !m_context.getActiveAttrib(program, index, info)) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    return CanvasActiveInfo::create(info.name, info.type, info.size);
+}
+
+PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    ActiveInfo info;
+    if (!program || program->context() != this || !m_context.getActiveUniform(program, index, info)) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    return CanvasActiveInfo::create(info.name, info.type, info.size);
+}
+
 int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
 {
     return m_context.getAttribLocation(program, name);
@@ -792,6 +814,13 @@ void CanvasRenderingContext3D::polygonOffset(double factor, double units)
     cleanupAfterGraphicsCall(false);
 }
 
+PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    RefPtr<CanvasArray> array = m_context.readPixels(x, y, width, height, format, type);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
 void CanvasRenderingContext3D::releaseShaderCompiler()
 {
     m_context.releaseShaderCompiler();
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
index a4a68fc..526281b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
 
+class CanvasActiveInfo;
 class CanvasBuffer;
 class CanvasFramebuffer;
 class CanvasObject;
@@ -123,7 +124,10 @@ class WebKitCSSMatrix;
         void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
-        
+
+        PassRefPtr<CanvasActiveInfo> getActiveAttrib(CanvasProgram*, unsigned long index, ExceptionCode&);
+        PassRefPtr<CanvasActiveInfo> getActiveUniform(CanvasProgram*, unsigned long index, ExceptionCode&);
+
         int  getAttribLocation(CanvasProgram*, const String& name);
 
         bool getBoolean(unsigned long pname);
@@ -187,8 +191,7 @@ class WebKitCSSMatrix;
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        // TBD
-        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
index 4b9a889..db0fff3 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
@@ -530,8 +530,11 @@ module html {
         void         generateMipmap(in unsigned long target);
         
         // FIXME: these need to be added per the WebGL spec
-        // CanvasActiveInfo getActiveAttrib(GLuint program, GLuint index);
-        // CanvasActiveInfo getActiveUniform(GLuint program, GLuint index);
+        CanvasActiveInfo getActiveAttrib(in CanvasProgram program, in unsigned long index)
+            raises (DOMException);
+        CanvasActiveInfo getActiveUniform(in CanvasProgram program, in unsigned long index)
+            raises (DOMException);
+
         // CanvasShaderArray glGetAttachedShaders(GLuint program);
 
         int          getAttribLocation(in CanvasProgram program, in DOMString name);
@@ -597,8 +600,7 @@ module html {
         void         pixelStorei(in unsigned long pname, in long param);
         void         polygonOffset(in double factor, in double units);
         
-        // FIXME
-        //void         readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type, void* pixels);
+        CanvasArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
         
         void         releaseShaderCompiler();
         void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
index 44fc18e..d0cf135 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
@@ -51,14 +51,14 @@ namespace WebCore {
                                                           unsigned length)
     {
         // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(short)) != 0) {
+        if ((offset % sizeof(short)) != 0)
             return NULL;
-        }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(short))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(short))) > buffer->byteLength())
+                return NULL;
         }
 
         return adoptRef(new CanvasShortArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
index 2ac86b5..1eeef0c 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
@@ -27,6 +27,7 @@
 #define CanvasShortArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasShortArray : public CanvasArray {
     public:
+        virtual bool isShortArray() const { return true; }
+
         static PassRefPtr<CanvasShortArray> create(unsigned length);
         static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
         static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
index 0ad7b2b..a75066c 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
@@ -50,10 +50,11 @@ namespace WebCore {
                                                                         int offset,
                                                                         unsigned length)
     {
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
+                return NULL;
         }
 
         return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
index f1b7348..d8864e0 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
@@ -27,6 +27,7 @@
 #define CanvasUnsignedByteArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedByteArray : public CanvasArray {
     public:
+        virtual bool isUnsignedByteArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
         static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
index e00e783..bd26343 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
@@ -55,10 +55,11 @@ namespace WebCore {
             return NULL;
         }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
+                return NULL;
         }
 
         return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
index 21f0d10..10b8edf 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
@@ -27,6 +27,7 @@
 #define CanvasUnsignedIntArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedIntArray : public CanvasArray {
     public:
+        virtual bool isUnsignedIntArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
         static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
index 03a4ce1..45d827b 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
@@ -55,10 +55,11 @@ namespace WebCore {
             return NULL;
         }
 
-        // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) {
-            return NULL;
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
+                return NULL;
         }
 
         return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
index 324e868..9e27566 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
@@ -27,6 +27,7 @@
 #define CanvasUnsignedShortArray_h
 
 #include "CanvasArray.h"
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedShortArray : public CanvasArray {
     public:
+        virtual bool isUnsignedShortArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
         static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
index 752ec0c..83a9719 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
@@ -46,6 +46,7 @@
 #include "InspectorFrontend.h"
 #include "InspectorResource.h"
 #include "Pasteboard.h"
+#include "ScriptArray.h"
 #include "ScriptFunctionCall.h"
 
 #if ENABLE(DOM_STORAGE)
@@ -257,33 +258,26 @@ const String& InspectorBackend::platform() const
     return platform;
 }
 
-void InspectorBackend::enableTimeline(bool always)
+void InspectorBackend::startTimelineProfiler()
 {
     if (m_inspectorController)
-        m_inspectorController->enableTimeline(always);
+        m_inspectorController->startTimelineProfiler();
 }
 
-void InspectorBackend::disableTimeline(bool always)
+void InspectorBackend::stopTimelineProfiler()
 {
     if (m_inspectorController)
-        m_inspectorController->disableTimeline(always);
+        m_inspectorController->stopTimelineProfiler();
 }
 
-bool InspectorBackend::timelineEnabled() const
+bool InspectorBackend::timelineProfilerEnabled() const
 {
     if (m_inspectorController)
-        return m_inspectorController->timelineEnabled();
+        return m_inspectorController->timelineProfilerEnabled();
     return false;
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-const ProfilesArray& InspectorBackend::profiles() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->profiles();
-    return m_emptyProfiles;
-}
-
 void InspectorBackend::startProfiling()
 {
     if (m_inspectorController)
@@ -315,6 +309,18 @@ bool InspectorBackend::profilerEnabled()
     return false;
 }
 
+void InspectorBackend::getProfileHeaders(long callId)
+{
+    if (m_inspectorController)
+        m_inspectorController->getProfileHeaders(callId);
+}
+
+void InspectorBackend::getProfile(long callId, unsigned uid)
+{
+    if (m_inspectorController)
+        m_inspectorController->getProfile(callId, uid);
+}
+
 void InspectorBackend::enableDebugger(bool always)
 {
     if (m_inspectorController)
@@ -395,7 +401,7 @@ void InspectorBackend::stepOutOfFunctionInDebugger()
 
 #endif
 
-void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments)
+void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
 {
     InspectorFrontend* frontend = inspectorFrontend();
     if (!frontend)
@@ -404,8 +410,12 @@ void InspectorBackend::dispatchOnInjectedScript(long callId, const String& metho
     ScriptFunctionCall function(m_inspectorController->m_scriptState, m_inspectorController->m_injectedScriptObj, "dispatch");
     function.appendArgument(methodName);
     function.appendArgument(arguments);
+    if (async)
+        function.appendArgument(static_cast<int>(callId));
     bool hadException = false;
     ScriptValue result = function.call(hadException);
+    if (async)
+        return;  // InjectedScript will return result asynchronously by means of ::reportDidDispatchOnInjectedScript.
     if (hadException)
         frontend->didDispatchOnInjectedScript(callId, "", true);
     else
@@ -450,18 +460,48 @@ void InspectorBackend::copyNode(long nodeId)
     String markup = createMarkup(node);
     Pasteboard::generalPasteboard()->writePlainText(markup);
 }
+    
+void InspectorBackend::removeNode(long callId, long nodeId)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
+
+    Node* node = nodeForId(nodeId);
+    if (!node) {
+        // Use -1 to denote an error condition.
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    Node* parentNode = node->parentNode();
+    if (!parentNode) {
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    ExceptionCode code;
+    parentNode->removeChild(node, code);
+    if (code) {
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    frontend->didRemoveNode(callId, nodeId);
+}
 
-void InspectorBackend::getCookies(long callId)
+void InspectorBackend::getCookies(long callId, const String& domain)
 {
-    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
-        domAgent->getCookies(callId);
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId, domain);
 }
 
-void InspectorBackend::deleteCookie(const String& cookieName)
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
 {
     if (!m_inspectorController)
         return;
-    m_inspectorController->deleteCookie(cookieName);
+    m_inspectorController->deleteCookie(cookieName, domain);
 }
 
 void InspectorBackend::highlight(long nodeId)
@@ -477,10 +517,10 @@ Node* InspectorBackend::nodeForId(long nodeId)
     return 0;
 }
 
-ScriptValue InspectorBackend::wrapObject(const ScriptValue& object)
+ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
 {
     if (m_inspectorController)
-        return m_inspectorController->wrapObject(object);
+        return m_inspectorController->wrapObject(object, objectGroup);
     return ScriptValue();
 }
 
@@ -491,6 +531,12 @@ ScriptValue InspectorBackend::unwrapObject(const String& objectId)
     return ScriptValue();
 }
 
+void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    if (m_inspectorController)
+        m_inspectorController->releaseWrapperObjectGroup(objectGroup);
+}
+
 long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
 {
     InspectorFrontend* frontend = inspectorFrontend();
@@ -510,10 +556,32 @@ void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
 }
 
 #if ENABLE(DATABASE)
+Database* InspectorBackend::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
 void InspectorBackend::selectDatabase(Database* database)
 {
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->selectDatabase(database);
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+
+void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend()) {
+        ScriptArray result = frontend->newScriptArray();
+        Database* database = m_inspectorController->databaseForId(databaseId);
+        if (database) {
+            Vector<String> tableNames = database->tableNames();
+            unsigned length = tableNames.size();
+            for (unsigned i = 0; i < length; ++i)
+                result.set(i, tableNames[i]);
+        }
+        frontend->didGetDatabaseTableNames(callId, result);
+    }
 }
 #endif
 
@@ -543,6 +611,18 @@ void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const S
 }
 #endif
 
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    if (m_inspectorController)
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
+}
+
+void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
 InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
 {
     if (!m_inspectorController)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
index 72278a3..9d75e2f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
@@ -95,13 +95,11 @@ public:
 
     const String& platform() const;
 
-    void enableTimeline(bool always);
-    void disableTimeline(bool always);
-    bool timelineEnabled() const;
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+    bool timelineProfilerEnabled() const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    const ProfilesArray& profiles() const;
-
     void startProfiling();
     void stopProfiling();
 
@@ -109,6 +107,9 @@ public:
     void disableProfiler(bool always);
     bool profilerEnabled();
 
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+
     void enableDebugger(bool always);
     void disableDebugger(bool always);
     bool debuggerEnabled() const;
@@ -130,26 +131,30 @@ public:
     void stepOutOfFunctionInDebugger();
 #endif
 
-    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments);
+    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
     void getChildNodes(long callId, long nodeId);
     void setAttribute(long callId, long elementId, const String& name, const String& value);
     void removeAttribute(long callId, long elementId, const String& name);
     void setTextNodeValue(long callId, long nodeId, const String& value);
     void getEventListenersForNode(long callId, long nodeId);
     void copyNode(long nodeId);
+    void removeNode(long callId, long nodeId);
 
-    void getCookies(long callId);
-    void deleteCookie(const String& cookieName);
+    void getCookies(long callId, const String& domain);
+    void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
     void highlight(long nodeId);
     Node* nodeForId(long nodeId);
-    ScriptValue wrapObject(const ScriptValue& object);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
     ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
     long pushNodePathToFrontend(Node* node, bool selectInUI);
     void addNodesToSearchResult(const String& nodeIds);
 #if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
     void selectDatabase(Database* database);
+    void getDatabaseTableNames(long callId, long databaseId);
 #endif
 #if ENABLE(DOM_STORAGE)
     void selectDOMStorage(Storage* storage);
@@ -157,6 +162,8 @@ public:
     void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
     void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
+    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
     InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
@@ -165,9 +172,6 @@ private:
 
     InspectorController* m_inspectorController;
     InspectorClient* m_client;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    ProfilesArray m_emptyProfiles;
-#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
index 5c6babb..7a00c6a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
@@ -52,17 +52,18 @@ module core {
         boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
         [Custom] void search(in Node node, in DOMString query);
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] DOMObject databaseTableNames(in Database database);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
         [Custom] DOMObject setting(in DOMString key);
         [Custom] void setSetting(in DOMString key, in DOMObject  value);
         [Custom] DOMWindow inspectedWindow();
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
         DOMString platform();
-        void enableTimeline(in boolean always);
-        void disableTimeline(in boolean always);
-        boolean timelineEnabled();
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
+        boolean timelineProfilerEnabled();
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
@@ -99,27 +100,32 @@ module core {
         void startProfiling();
         void stopProfiling();
 
-        [Custom] Array profiles();
+        void getProfileHeaders(in long callId);
+        void getProfile(in long callId, in unsigned long uid);
 #endif
-        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments);
+        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments, in boolean async);
         void getChildNodes(in long callId, in long nodeId);
         void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
         void removeAttribute(in long callId, in long elementId, in DOMString name);
         void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
         void getEventListenersForNode(in long callId, in long nodeId);
         void copyNode(in long nodeId);
+        void removeNode(in long callId, in long nodeId);
 
-        void getCookies(in long callId);
-        void deleteCookie(in DOMString cookieName);
+        void getCookies(in long callId, in DOMString domain);
+        void deleteCookie(in DOMString cookieName, in DOMString domain);
 
         // Called from InjectedScript.
+        // TODO: extract into a separate IDL.
         [Custom] DOMObject nodeForId(in long nodeId);
-        [Custom] long wrapObject(in DOMObject object);
+        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
         [Custom] DOMObject unwrapObject(in long objectId);
+        void releaseWrapperObjectGroup(in DOMString objectGroup);
         [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
         void addNodesToSearchResult(in DOMString nodeIds);
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         [Custom] void selectDatabase(in DOMObject database);
+        [Custom] DOMObject databaseForId(in long databaseId);
 #endif
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         [Custom] void selectDOMStorage(in DOMObject storage);
@@ -127,5 +133,7 @@ module core {
         void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
         void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
 #endif
+        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index bb77ebf..a5b8cbf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -36,6 +36,7 @@
 #include "CachedResource.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
+#include "Cookie.h"
 #include "CookieJar.h"
 #include "Document.h"
 #include "DocumentLoader.h"
@@ -76,6 +77,7 @@
 #include "TextEncoding.h"
 #include "TextIterator.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
@@ -105,12 +107,12 @@ using namespace std;
 namespace WebCore {
 
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
+static const char* const CPUProfileType = "CPU";
 static const char* const resourceTrackingEnabledSettingName = "resourceTrackingEnabled";
 static const char* const debuggerEnabledSettingName = "debuggerEnabled";
 static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
-static const char* const timelineEnabledSettingName = "timelineEnabled";
 
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
@@ -179,11 +181,6 @@ void InspectorController::inspectedPageDestroyed()
     if (m_scriptState)
         ScriptGlobalObject::remove(m_scriptState, "InspectorController");
 
-    if (m_page) {
-        m_page->setParentInspectorController(0);
-        m_page = 0;
-    }
-
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
 
@@ -380,7 +377,7 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
         m_consoleMessages.append(consoleMessage);
     }
 
-    if (m_frontend)
+    if (windowVisible())
         m_previousMessage->addToConsole(m_frontend.get());
 }
 
@@ -390,7 +387,7 @@ void InspectorController::clearConsoleMessages(bool clearUI)
     m_consoleMessages.clear();
     m_previousMessage = 0;
     m_groupLevel = 0;
-    m_idToConsoleObject.clear();
+    releaseWrapperObjectGroup("console");
     if (m_domAgent)
         m_domAgent->releaseDanglingNodes();
     if (clearUI && m_frontend)
@@ -556,10 +553,7 @@ void InspectorController::setFrontendProxyObject(ScriptState* scriptState, Scrip
     m_injectedScriptObj = injectedScriptObj;
     m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
     m_domAgent = new InspectorDOMAgent(m_frontend.get());
-
-    Setting timelineEnabled = setting(timelineEnabledSettingName);
-    if (timelineEnabled.type() == Setting::BooleanType && timelineEnabled.booleanValue())
-        m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
+    m_timelineAgent = 0;
 }
 
 void InspectorController::show()
@@ -621,6 +615,9 @@ void InspectorController::close()
     m_domAgent = 0;
     m_timelineAgent = 0;
     m_scriptState = 0;
+    if (m_page)
+        m_page->setParentInspectorController(0);
+    m_page = 0;
 }
 
 void InspectorController::showWindow()
@@ -654,25 +651,32 @@ void InspectorController::populateScriptObjects()
     m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         it->second->createScriptObject(m_frontend.get());
+        m_frontend->addCookieDomain(it->second->frame()->document()->url().host());
+    }
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
         m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 
     m_frontend->populateInterface();
+
+    // Dispatch pending frontend commands
+    for (Vector<pair<long, String> >::iterator it = m_pendingEvaluateTestCommands.begin(); it != m_pendingEvaluateTestCommands.end(); ++it)
+        m_frontend->evaluateForTestInFrontend((*it).first, (*it).second);
+    m_pendingEvaluateTestCommands.clear();
 }
 
 void InspectorController::resetScriptObjects()
@@ -685,14 +689,14 @@ void InspectorController::resetScriptObjects()
         it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->unbind();
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->unbind();
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->unbind();
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->unbind();
 #endif
 
     if (m_timelineAgent)
@@ -700,6 +704,8 @@ void InspectorController::resetScriptObjects()
 
     m_frontend->reset();
     m_domAgent->setDocument(0);
+    m_objectGroups.clear();
+    m_idToWrappedObject.clear();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -715,7 +721,7 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (m_frontend)
+            if (windowVisible())
                 resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
@@ -756,7 +762,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                m_mainResource->createScriptObject(m_frontend.get());
+                if (windowVisible())
+                    m_mainResource->createScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -850,7 +857,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     ensureResourceTrackingSettingsLoaded();
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
-    
+
     RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
 
     if (isMainResource) {
@@ -860,7 +867,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible())
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -886,10 +893,34 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
+    if (windowVisible() && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
         resource->createScriptObject(m_frontend.get());
 }
 
+void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource) {
+        m_mainResource->markDOMContentEventTime();
+        if (windowVisible())
+            m_mainResource->updateScriptObject(m_frontend.get());
+    }
+}
+
+void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource) {
+        m_mainResource->markLoadEventTime();
+        if (windowVisible())
+            m_mainResource->updateScriptObject(m_frontend.get());
+    }
+}
+
 bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
 {
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
@@ -908,7 +939,7 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && m_frontend)
+    if (resource != m_mainResource && windowVisible())
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -921,7 +952,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -933,7 +964,7 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -949,8 +980,10 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible()) {
         resource->updateScriptObject(m_frontend.get());
+        m_frontend->addCookieDomain(resource->frame()->document()->url().host());
+    }
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
@@ -966,7 +999,7 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -981,7 +1014,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -998,7 +1031,7 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1046,47 +1079,62 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         m_resourceTrackingEnabled = true;
 }
 
-void InspectorController::enableTimeline(bool always)
+void InspectorController::startTimelineProfiler()
 {
     if (!enabled())
         return;
 
-    if (always)
-        setSetting(timelineEnabledSettingName, Setting(true));
-
-    if (m_timelineAgent.get())
+    if (m_timelineAgent)
         return;
 
     m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
     if (m_frontend)
-        m_frontend->timelineWasEnabled();
+        m_frontend->timelineProfilerWasStarted();
 }
 
-void InspectorController::disableTimeline(bool always)
+void InspectorController::stopTimelineProfiler()
 {
     if (!enabled())
         return;
 
-    if (always)
-        setSetting(timelineEnabledSettingName, Setting(false));
-
-    if (!m_timelineAgent.get())
+    if (!m_timelineAgent)
         return;
 
-    m_timelineAgent.set(0);
+    m_timelineAgent = 0;
     if (m_frontend)
-        m_frontend->timelineWasDisabled();
+        m_frontend->timelineProfilerWasStopped();
 }
 
-bool InspectorController::timelineEnabled() const
+bool InspectorController::timelineProfilerEnabled() const
 {
     if (!enabled())
         return false;
 
-    return m_timelineAgent.get();
+    return m_timelineAgent;
 }
 
 #if ENABLE(DATABASE)
+void InspectorController::selectDatabase(Database* database)
+{
+    if (!m_frontend)
+        return;
+
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != m_databaseResources.end(); ++it) {
+        if (it->second->database() == database) {
+            m_frontend->selectDatabase(it->first);
+            break;
+        }
+    }
+}
+
+Database* InspectorController::databaseForId(int databaseId)
+{
+    DatabaseResourcesMap::iterator it = m_databaseResources.find(databaseId);
+    if (it == m_databaseResources.end())
+        return 0;
+    return it->second->database();
+}
+
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
 {
     if (!enabled())
@@ -1094,32 +1142,101 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 
     RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
 
-    m_databaseResources.add(resource);
+    m_databaseResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (m_frontend && windowVisible())
+    if (windowVisible())
         resource->bind(m_frontend.get());
 }
 #endif
 
+void InspectorController::getCookies(long callId, const String& host)
+{
+    if (!m_frontend)
+        return;
+    
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+    
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+    
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+    
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == host) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
+            
+            if (!rawCookiesImplemented)
+                // FIXME: We need duplication checking for the String representation of cookies.
+                stringCookiesList += document->cookie();
+            else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+    
+    if (!rawCookiesImplemented)
+        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
+    else
+        m_frontend->didGetCookies(callId, buildArrayForCookies(rawCookiesList), String());
+}
+    
+ScriptArray InspectorController::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    ScriptArray cookies = m_frontend->newScriptArray();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies.set(i, buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+ScriptObject InspectorController::buildObjectForCookie(const Cookie& cookie)
+{
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("name", cookie.name);
+    value.set("value", cookie.value);
+    value.set("domain", cookie.domain);
+    value.set("path", cookie.path);
+    value.set("expires", cookie.expires);
+    value.set("size", (cookie.name.length() + cookie.value.length()));
+    value.set("httpOnly", cookie.httpOnly);
+    value.set("secure", cookie.secure);
+    value.set("session", cookie.session);
+    return value;
+}
+    
 #if ENABLE(DOM_STORAGE)
 void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
 {
     if (!enabled())
         return;
 
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if ((*it)->isSameHostAndType(frame, isLocalStorage))
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if (it->second->isSameHostAndType(frame, isLocalStorage))
             return;
 
     RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
     RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
 
-    m_domStorageResources.add(resource);
+    m_domStorageResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (m_frontend && windowVisible())
+    if (windowVisible())
         resource->bind(m_frontend.get());
 }
 
@@ -1132,10 +1249,10 @@ void InspectorController::selectDOMStorage(Storage* storage)
     Frame* frame = storage->frame();
     bool isLocalStorage = (frame->domWindow()->localStorage() == storage);
     int storageResourceId = 0;
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
-        if ((*it)->isSameHostAndType(frame, isLocalStorage)) {
-            storageResourceId = (*it)->id();
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
+        if (it->second->isSameHostAndType(frame, isLocalStorage)) {
+            storageResourceId = it->first;
             break;
         }
     }
@@ -1196,11 +1313,10 @@ void InspectorController::removeDOMStorageItem(long callId, long storageId, cons
 
 InspectorDOMStorageResource* InspectorController::getDOMStorageResourceForId(int storageId)
 {
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if ((*it)->id() == storageId)
-            return it->get();
-    return 0;
+    DOMStorageResourcesMap::iterator it = m_domStorageResources.find(storageId);
+    if (it == m_domStorageResources.end())
+        return 0;
+    return it->second.get();
 }
 #endif
 
@@ -1221,11 +1337,11 @@ void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned li
         return;
 
     RefPtr<Profile> profile = prpProfile;
-    m_profiles.append(profile);
+    m_profiles.add(profile->uid(), profile);
 
     if (m_frontend) {
         JSLock lock(SilenceAssertionsOnly);
-        m_frontend->addProfile(toJS(m_scriptState, profile.get()));
+        m_frontend->addProfileHeader(createProfileHeader(*profile));
     }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
@@ -1236,8 +1352,10 @@ void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile>
     RefPtr<Profile> profile = prpProfile;
 
     UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(profile->title());
+    message += encodeWithURLEscapeSequences(CPUProfileType);
     message += "/";
+    message += encodeWithURLEscapeSequences(profile->title());
+    message += "#";
     message += UString::from(profile->uid());
     message += "\" finished.";
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
@@ -1246,11 +1364,42 @@ void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile>
 void InspectorController::addStartProfilingMessageToConsole(const UString& title, unsigned lineNumber, const UString& sourceURL)
 {
     UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(CPUProfileType);
+    message += "/";
     message += encodeWithURLEscapeSequences(title);
-    message += "/0\" started.";
+    message += "#0\" started.";
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
+void InspectorController::getProfileHeaders(long callId)
+{
+    if (!m_frontend)
+        return;
+    ScriptArray result = m_frontend->newScriptArray();
+    ProfilesMap::iterator profilesEnd = m_profiles.end();
+    int i = 0;
+    for (ProfilesMap::iterator it = m_profiles.begin(); it != profilesEnd; ++it)
+        result.set(i++, createProfileHeader(*it->second));
+    m_frontend->didGetProfileHeaders(callId, result);
+}
+
+void InspectorController::getProfile(long callId, unsigned uid)
+{
+    if (!m_frontend)
+        return;
+    ProfilesMap::iterator it = m_profiles.find(uid);
+    if (it != m_profiles.end())
+        m_frontend->didGetProfile(callId, toJS(m_scriptState, it->second.get()));
+}
+
+ScriptObject InspectorController::createProfileHeader(const JSC::Profile& profile)
+{
+    ScriptObject header = m_frontend->newScriptObject();
+    header.set("title", profile.title());
+    header.set("uid", profile.uid());
+    return header;
+}
+
 UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
@@ -1429,6 +1578,25 @@ void InspectorController::didContinue()
 
 #endif
 
+void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
+{
+    if (m_frontend)
+        m_frontend->evaluateForTestInFrontend(callId, script);
+    else
+        m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
+}
+
+void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptObject window;
+    ScriptGlobalObject::get(scriptState, "window", window);
+    ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
+    function.appendArgument(static_cast<int>(callId));
+    function.appendArgument(jsonResult);
+    function.call();
+}
+
 static Path quadToPath(const FloatQuad& quad)
 {
     Path quadPath;
@@ -1623,15 +1791,18 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ElementsPanel;
 }
 
-ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject)
+ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject, const String& objectGroup)
 {
     ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "createProxyObject");
     function.appendArgument(quarantinedObject);
     if (quarantinedObject.isObject()) {
         long id = m_lastBoundObjectId++;
         String objectId = String::format("object#%ld", id);
-        m_idToConsoleObject.set(objectId, quarantinedObject);
-
+        m_idToWrappedObject.set(objectId, quarantinedObject);
+        ObjectGroupsMap::iterator it = m_objectGroups.find(objectGroup);
+        if (it == m_objectGroups.end())
+            it = m_objectGroups.set(objectGroup, Vector<String>()).first;
+        it->second.append(objectId);
         function.appendArgument(objectId);
     }
     ScriptValue wrapper = function.call();
@@ -1640,22 +1811,38 @@ ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject
 
 ScriptValue InspectorController::unwrapObject(const String& objectId)
 {
-    HashMap<String, ScriptValue>::iterator it = m_idToConsoleObject.find(objectId);
-    if (it != m_idToConsoleObject.end())
+    HashMap<String, ScriptValue>::iterator it = m_idToWrappedObject.find(objectId);
+    if (it != m_idToWrappedObject.end())
         return it->second;
     return ScriptValue();
 }
 
+void InspectorController::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    ObjectGroupsMap::iterator groupIt = m_objectGroups.find(objectGroup);
+    if (groupIt == m_objectGroups.end())
+        return;
+
+    Vector<String>& groupIds = groupIt->second;
+    for (Vector<String>::iterator it = groupIds.begin(); it != groupIds.end(); ++it)
+        m_idToWrappedObject.remove(*it);
+    m_objectGroups.remove(groupIt);
+}
+
 void InspectorController::resetInjectedScript()
 {
     ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "reset");
     function.call();
 }
 
-void InspectorController::deleteCookie(const String& cookieName)
+void InspectorController::deleteCookie(const String& cookieName, const String& domain)
 {
-    Document* document = m_inspectedPage->mainFrame()->document();
-    WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == domain)
+            WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index ff7a516..8c14532 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -30,7 +30,9 @@
 #define InspectorController_h
 
 #include "Console.h"
+#include "Cookie.h"
 #include "PlatformString.h"
+#include "ScriptArray.h"
 #include "ScriptObject.h"
 #include "ScriptState.h"
 #include "ScriptValue.h"
@@ -39,6 +41,7 @@
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
@@ -90,8 +93,9 @@ class InspectorController
 public:
     typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
-    typedef HashSet<RefPtr<InspectorDatabaseResource> > DatabaseResourcesSet;
-    typedef HashSet<RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesSet;
+    typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    typedef HashMap<String, Vector<String> > ObjectGroupsMap;
 
     typedef enum {
         CurrentPanel,
@@ -224,11 +228,16 @@ public:
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
 
-    void enableTimeline(bool always = false);
-    void disableTimeline(bool always = false);
-    bool timelineEnabled() const;
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+    bool timelineProfilerEnabled() const;
     InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
 
+    void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
+    void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
+                                                        
+    void getCookies(long callId, const String& url);
+
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
@@ -256,7 +265,6 @@ public:
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
-    const ProfilesArray& profiles() const { return m_profiles; }
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
 
@@ -280,6 +288,8 @@ public:
     virtual void didContinue();
 #endif
 
+    void evaluateForTestInFrontend(long callId, const String& script);
+
 private:
     friend class InspectorBackend;
     // Following are used from InspectorBackend and internally.
@@ -295,21 +305,34 @@ private:
     // Following are used from InspectorFrontend only. We don't want to expose them to the
     // rest of the InspectorController clients.
     // TODO: extract these into a separate interface.
-    ScriptValue wrapObject(const ScriptValue& object);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
     ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
     
     void resetInjectedScript();
 
-    void deleteCookie(const String& cookieName);
+    void deleteCookie(const String& cookieName, const String& domain);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    typedef HashMap<unsigned int, RefPtr<JSC::Profile> > ProfilesMap;
+
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+    ScriptObject createProfileHeader(const JSC::Profile& profile);
+#endif
+#if ENABLE(DATABASE)
+    void selectDatabase(Database* database);
+    Database* databaseForId(int databaseId);
 #endif
 #if ENABLE(DOM_STORAGE)
     InspectorDOMStorageResource* getDOMStorageResourceForId(int storageId);
 #endif
+                                                        
+    ScriptObject buildObjectForCookie(const Cookie&);
+    ScriptArray buildArrayForCookies(ListHashSet<Cookie>&);
 
     void focusNode();
 
@@ -328,6 +351,8 @@ private:
 
     SpecialPanels specialPanelForJSName(const String& panelName);
 
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
     Page* m_inspectedPage;
     InspectorClient* m_client;
     OwnPtr<InspectorFrontend> m_frontend;
@@ -344,10 +369,10 @@ private:
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet m_databaseResources;
+    DatabaseResourcesMap m_databaseResources;
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet m_domStorageResources;
+    DOMStorageResourcesMap m_domStorageResources;
 #endif
     ScriptState* m_scriptState;
     bool m_windowVisible;
@@ -360,8 +385,11 @@ private:
     bool m_resourceTrackingEnabled;
     bool m_resourceTrackingSettingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
-    HashMap<String, ScriptValue> m_idToConsoleObject;
+    HashMap<String, ScriptValue> m_idToWrappedObject;
+    ObjectGroupsMap m_objectGroups;
+
     long m_lastBoundObjectId;
+    Vector<pair<long, String> > m_pendingEvaluateTestCommands;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
     bool m_attachDebuggerWhenShown;
@@ -370,7 +398,7 @@ private:
     int m_currentUserInitiatedProfileNumber;
     unsigned m_nextUserInitiatedProfileNumber;
     Timer<InspectorController> m_startProfiling;
-    ProfilesArray m_profiles;
+    ProfilesMap m_profiles;
 #endif
 };
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
index ad8e8b8..f6c2d46 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
@@ -438,18 +438,6 @@ void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
     m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
 }
 
-void InspectorDOMAgent::getCookies(long callId)
-{
-    Document* doc = mainFrameDocument();
-    Vector<Cookie> cookiesList;
-    bool isImplemented = getRawCookies(doc, doc->cookieURL(), cookiesList);
-
-    if (!isImplemented)
-        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), doc->cookie());
-    else
-        m_frontend->didGetCookies(callId, buildArrayForCookies(cookiesList), String());
-}
-
 ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap)
 {
     ScriptObject value = m_frontend->newScriptObject();
@@ -549,32 +537,6 @@ ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEven
     return value;
 }
 
-ScriptObject InspectorDOMAgent::buildObjectForCookie(const Cookie& cookie)
-{
-    ScriptObject value = m_frontend->newScriptObject();
-    value.set("name", cookie.name);
-    value.set("value", cookie.value);
-    value.set("domain", cookie.domain);
-    value.set("path", cookie.path);
-    value.set("expires", cookie.expires);
-    value.set("size", static_cast<int>(cookie.name.length() + cookie.value.length()));
-    value.set("httpOnly", cookie.httpOnly);
-    value.set("secure", cookie.secure);
-    value.set("session", cookie.session);
-    return value;
-}
-
-ScriptArray InspectorDOMAgent::buildArrayForCookies(const Vector<Cookie>& cookiesList)
-{
-    ScriptArray cookies = m_frontend->newScriptArray();
-    unsigned length = cookiesList.size();
-    for (unsigned i = 0; i < length; ++i) {
-        const Cookie& cookie = cookiesList[i];
-        cookies.set(i, buildObjectForCookie(cookie));
-    }
-    return cookies;
-}
-
 Node* InspectorDOMAgent::innerFirstChild(Node* node)
 {
     if (node->isFrameOwnerElement()) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
index 548e2b2..b9bdb6b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
@@ -53,8 +53,6 @@ namespace WebCore {
     class Node;
     class Page;
 
-    struct Cookie;
-
     struct EventListenerInfo {
         EventListenerInfo(Node* node, const AtomicString& eventType, const EventListenerVector& eventListenerVector)
             : node(node)
@@ -88,7 +86,6 @@ namespace WebCore {
         void removeAttribute(long callId, long elementId, const String& name);
         void setTextNodeValue(long callId, long nodeId, const String& value);
         void getEventListenersForNode(long callId, long nodeId);
-        void getCookies(long callId);
 
         // Methods called from the InspectorController.
         void setDocument(Document* document);
@@ -116,9 +113,6 @@ namespace WebCore {
 
         ScriptObject buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node);
 
-        ScriptObject buildObjectForCookie(const Cookie& cookie);
-        ScriptArray buildArrayForCookies(const Vector<Cookie>& cookiesList);
-
         // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
         // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
         Node* innerFirstChild(Node* node);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
index 37818e7..c93e987 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -104,7 +104,7 @@ void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* ev
     ASSERT(eventNames().storageEvent == event->type());
     StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
     Storage* storage = storageEvent->storageArea();
-    bool isLocalStorage = storageEvent->source()->localStorage() == storage;
+    bool isLocalStorage = storage->frame()->domWindow()->localStorage() == storage;
     if (isSameHostAndType(storage->frame(), isLocalStorage))
         m_frontend->updateDOMStorage(m_id);
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
index a58968f..c2dc5c6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -41,8 +41,11 @@
 
 namespace WebCore {
 
+int InspectorDatabaseResource::s_nextUnusedId = 1;
+
 InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
     : m_database(database)
+    , m_id(s_nextUnusedId++)
     , m_domain(domain)
     , m_name(name)
     , m_version(version)
@@ -59,7 +62,7 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
     ScriptObject database;
     if (!getQuarantinedScriptObject(m_database.get(), database))
         return;
-    jsonObject.set("database", database);
+    jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
     jsonObject.set("version", m_version);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
index 38f9fa1..f82d898 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
@@ -53,16 +53,19 @@ namespace WebCore {
 
         void bind(InspectorFrontend* frontend);
         void unbind();
-
+        Database* database() { return m_database.get(); }
+        long id() const { return m_id; }
     private:
         InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
         
         RefPtr<Database> m_database;
+        int m_id;
         String m_domain;
         String m_name;
         String m_version;
         bool m_scriptObjectCreated;
 
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
index 63bb6e2..2e6dc2b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -87,7 +87,7 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
             function->appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i]));
+            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
     } else
         function->appendArgument(message);
     function->call();
@@ -125,6 +125,13 @@ void InspectorFrontend::removeResource(long long identifier)
     function->call();
 }
 
+void InspectorFrontend::addCookieDomain(String domain)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
+    function->appendArgument(domain);
+    function->call();
+}
+
 void InspectorFrontend::updateFocusedNode(long long nodeId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
@@ -190,14 +197,14 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
-void InspectorFrontend::timelineWasEnabled()
+void InspectorFrontend::timelineProfilerWasStarted()
 {
-    callSimpleFunction("timelineWasEnabled");
+    callSimpleFunction("timelineProfilerWasStarted");
 }
 
-void InspectorFrontend::timelineWasDisabled()
+void InspectorFrontend::timelineProfilerWasStopped()
 {
-    callSimpleFunction("timelineWasDisabled");
+    callSimpleFunction("timelineProfilerWasStopped");
 }
 
 void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
@@ -254,9 +261,9 @@ void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source,
     function->call();
 }
 
-void InspectorFrontend::addProfile(const JSC::JSValue& profile)
+void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfile"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfileHeader"));
     function->appendArgument(profile);
     function->call();
 }
@@ -268,38 +275,32 @@ void InspectorFrontend::setRecordingProfile(bool isProfiling)
     function->call();
 }
 
-void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
+void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
-    function->appendArgument(callFrames);
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfileHeaders"));
+    function->appendArgument(callId);
+    function->appendArgument(headers);
     function->call();
 }
 
-void InspectorFrontend::resumedScript()
+void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
 {
-    callSimpleFunction("resumedScript");
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfile"));
+    function->appendArgument(callId);
+    function->appendArgument(profile);
+    function->call();
 }
-#endif
 
-#if ENABLE(DATABASE)
-bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
+    function->appendArgument(callFrames);
+    function->call();
 }
-#endif
 
-#if ENABLE(DOM_STORAGE)
-bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
+void InspectorFrontend::resumedScript()
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
+    callSimpleFunction("resumedScript");
 }
 #endif
 
@@ -358,6 +359,14 @@ void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
     function->call();
 }
 
+void InspectorFrontend::didRemoveNode(int callId, int nodeId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveNode"));
+    function->appendArgument(callId);
+    function->appendArgument(nodeId);
+    function->call();
+}
+
 void InspectorFrontend::didGetChildNodes(int callId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
@@ -401,18 +410,40 @@ void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& re
 }
 
 #if ENABLE(DATABASE)
-void InspectorFrontend::selectDatabase(Database* database)
+bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::selectDatabase(int databaseId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
-    ScriptObject quarantinedObject;
-    if (!getQuarantinedScriptObject(database, quarantinedObject))
-        return;
-    function->appendArgument(quarantinedObject);
+    function->appendArgument(databaseId);
+    function->call();
+}
+void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
+    function->appendArgument(callId);
+    function->appendArgument(tableNames);
     function->call();
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
 void InspectorFrontend::selectDOMStorage(int storageId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
@@ -459,6 +490,14 @@ void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
     function->call();
 }
 
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
+    function->appendArgument(callId);
+    function->appendArgument(script);
+    function->call();
+}
+
 PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
 {
     ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
index 51f17fb..0883ac2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -70,6 +70,8 @@ namespace WebCore {
         bool updateResource(long long identifier, const ScriptObject& resourceObj);
         void removeResource(long long identifier);
 
+        void addCookieDomain(String);
+
         void updateFocusedNode(long long nodeId);
         void setAttachedWindow(bool attached);
         void showPanel(int panel);
@@ -87,15 +89,18 @@ namespace WebCore {
         void profilerWasDisabled();
         void parsedScriptSource(const JSC::SourceCode&);
         void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
-        void addProfile(const JSC::JSValue& profile);
+        void addProfileHeader(const ScriptValue& profile);
         void setRecordingProfile(bool isProfiling);
+        void didGetProfileHeaders(int callId, const ScriptArray& headers);
+        void didGetProfile(int callId, const ScriptValue& profile);
         void pausedScript(const ScriptValue& callFrames);
         void resumedScript();
 #endif
 
 #if ENABLE(DATABASE)
         bool addDatabase(const ScriptObject& dbObj);
-        void selectDatabase(Database* database);
+        void selectDatabase(int databaseId);
+        void didGetDatabaseTableNames(int callId, const ScriptArray& tableNames);
 #endif
         
 #if ENABLE(DOM_STORAGE)
@@ -117,9 +122,10 @@ namespace WebCore {
         void didGetChildNodes(int callId);
         void didApplyDomChange(int callId, bool success);
         void didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray);
+        void didRemoveNode(int callId, int nodeId);
 
-        void timelineWasEnabled();
-        void timelineWasDisabled();
+        void timelineProfilerWasStarted();
+        void timelineProfilerWasStopped();
         void addItemToTimeline(const ScriptObject& itemObj);
 
         void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
@@ -129,6 +135,7 @@ namespace WebCore {
 
         ScriptState* scriptState() const { return m_scriptState; }
 
+        void evaluateForTestInFrontend(int callId, const String& script);
     private:
         PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
index 484a0bd..69ab39b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -59,6 +59,8 @@ InspectorResource::InspectorResource(long long identifier, DocumentLoader* loade
     , m_startTime(-1.0)
     , m_responseReceivedTime(-1.0)
     , m_endTime(-1.0)
+    , m_loadEventTime(-1.0)
+    , m_domContentEventTime(-1.0)
     , m_isMainResource(false)
 {
 }
@@ -200,6 +202,10 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             jsonObject.set("responseReceivedTime", m_responseReceivedTime);
         if (m_endTime > 0)
             jsonObject.set("endTime", m_endTime);
+        if (m_loadEventTime > 0)
+            jsonObject.set("loadEventTime", m_loadEventTime);
+        if (m_domContentEventTime > 0)
+            jsonObject.set("domContentEventTime", m_domContentEventTime);
         jsonObject.set("didTimingChange", true);
     }
     if (!frontend->updateResource(m_identifier, jsonObject))
@@ -320,6 +326,18 @@ void InspectorResource::endTiming()
     m_changes.set(CompletionChange);
 }
 
+void InspectorResource::markDOMContentEventTime()
+{
+    m_domContentEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markLoadEventTime()
+{
+    m_loadEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
 void InspectorResource::markFailed()
 {
     m_failed = true;
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
index 5e37e41..880eab7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -103,6 +103,8 @@ namespace WebCore {
 
         void startTiming();
         void markResponseReceivedTime();
+        void markLoadEventTime();
+        void markDOMContentEventTime();
         void endTiming();
 
         void markFailed();
@@ -161,6 +163,8 @@ namespace WebCore {
         double m_startTime;
         double m_responseReceivedTime;
         double m_endTime;
+        double m_loadEventTime;
+        double m_domContentEventTime;
         ScriptString m_xmlHttpResponseText;
         Changes m_changes;
         bool m_isMainResource;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
index e86b0eb..47cdac2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
@@ -44,7 +44,12 @@ namespace WebCore {
             return adoptRef(new JavaScriptCallFrame(debuggerCallFrame, caller, sourceID, line));
         }
 
-        void invalidate() { m_isValid = false; }
+        void invalidate()
+        {
+            m_isValid = false;
+            m_debuggerCallFrame = 0;
+        }
+
         bool isValid() const { return m_isValid; }
 
         JavaScriptCallFrame* caller();
@@ -56,6 +61,7 @@ namespace WebCore {
             m_debuggerCallFrame = debuggerCallFrame;
             m_line = line;
             m_sourceID = sourceID;
+            m_isValid = true;
         }
 
         String functionName() const;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
index 3c3e279..2d462f6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
@@ -104,28 +104,6 @@ static JSValueRef getSelfTime(JSContextRef ctx, JSObjectRef thisObject, JSString
     return JSValueMakeNumber(ctx, profileNode->selfTime());
 }
 
-static JSValueRef getTotalPercent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeNumber(ctx, profileNode->totalPercent());
-}
-
-static JSValueRef getSelfPercent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeNumber(ctx, profileNode->selfPercent());
-}
-
 static JSValueRef getNumberOfCalls(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -184,30 +162,6 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     return result;
 }
 
-static JSValueRef getParent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    ExecState* exec = toJS(ctx);
-    return toRef(exec, toJS(exec, profileNode->parent()));
-}
-
-static JSValueRef getHead(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    ExecState* exec = toJS(ctx);
-    return toRef(exec, toJS(exec, profileNode->head()));
-}
-
 static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -245,12 +199,8 @@ JSClassRef ProfileNodeClass()
         { "lineNumber", getLineNumber, 0, kJSPropertyAttributeNone },
         { "totalTime", getTotalTime, 0, kJSPropertyAttributeNone },
         { "selfTime", getSelfTime, 0, kJSPropertyAttributeNone },
-        { "totalPercent", getTotalPercent, 0, kJSPropertyAttributeNone },
-        { "selfPercent", getSelfPercent, 0, kJSPropertyAttributeNone },
         { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
         { "children", getChildren, 0, kJSPropertyAttributeNone },
-        { "parent", getParent, 0, kJSPropertyAttributeNone },
-        { "head", getHead, 0, kJSClassAttributeNone },
         { "visible", getVisible, 0, kJSPropertyAttributeNone },
         { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
index 4f50ecc..aa0e08c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
@@ -27,6 +27,8 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+const ExpressionStopCharacters = " =:[({;,!+-*/&|^<>";
+
 WebInspector.ConsoleView = function(drawer)
 {
     WebInspector.View.call(this, document.getElementById("console-view"));
@@ -44,7 +46,7 @@ WebInspector.ConsoleView = function(drawer)
 
     this.promptElement = document.getElementById("console-prompt");
     this.promptElement.handleKeyEvent = this._promptKeyDown.bind(this);
-    this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), " .=:[({;");
+    this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), ExpressionStopCharacters + ".");
 
     this.topGroup = new WebInspector.ConsoleGroup(null, 0);
     this.messagesElement.insertBefore(this.topGroup.element, this.promptElement);
@@ -274,8 +276,7 @@ WebInspector.ConsoleView.prototype = {
     completions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         // Pass less stop characters to rangeOfWord so the range will be a more complete expression.
-        const expressionStopCharacters = " =:{;";
-        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, expressionStopCharacters, this.promptElement, "backward");
+        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, this.promptElement, "backward");
         var expressionString = expressionRange.toString();
         var lastIndex = expressionString.length - 1;
 
@@ -292,16 +293,6 @@ WebInspector.ConsoleView.prototype = {
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
         // Collect comma separated object properties for the completion.
 
-        if (!expressionString) {
-            if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-                // Evaluate into properties in scope of the selected call frame.
-                reportCompletions(WebInspector.panels.scripts.variablesInSelectedCallFrame());
-                return;
-            } else {
-                expressionString = "this";
-            }
-        }
-
         var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
             var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
@@ -343,7 +334,7 @@ WebInspector.ConsoleView.prototype = {
             if (bestMatchOnly)
                 break;
         }
-        setTimeout(completionsReadyCallback, 0, results);
+        completionsReadyCallback(results);
     },
 
     _clearButtonClicked: function()
@@ -391,16 +382,16 @@ WebInspector.ConsoleView.prototype = {
         this.prompt.handleKeyEvent(event);
     },
 
-    evalInInspectedWindow: function(expression, callback)
+    evalInInspectedWindow: function(expression, objectGroup, callback)
     {
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
+            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, objectGroup, callback);
             return;
         }
-        this.doEvalInWindow(expression, callback);
+        this.doEvalInWindow(expression, objectGroup, callback);
     },
 
-    doEvalInWindow: function(expression, callback)
+    doEvalInWindow: function(expression, objectGroup, callback)
     {
         if (!expression) {
             // There is no expression, so the completion should happen against global properties.
@@ -411,7 +402,7 @@ WebInspector.ConsoleView.prototype = {
         {
             callback(result.value, result.isException);
         };
-        InjectedScriptAccess.evaluate(expression, evalCallback);
+        InjectedScriptAccess.evaluate(expression, objectGroup, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -439,7 +430,7 @@ WebInspector.ConsoleView.prototype = {
             self.prompt.text = "";
             self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
         }
-        this.evalInInspectedWindow(str, printResult);
+        this.evalInInspectedWindow(str, "console", printResult);
     },
 
     _format: function(output, forceObjectFormat)
@@ -514,21 +505,31 @@ WebInspector.ConsoleView.prototype = {
 
     _formatarray: function(arr, elem)
     {
-        var self = this;
-        function printResult(properties)
-        {
-            if (!properties)
-                return;
-            elem.appendChild(document.createTextNode("["));
-            for (var i = 0; i < properties.length; ++i) {
-                var property = properties[i].value;
-                elem.appendChild(self._format(property));
-                if (i < properties.length - 1)
-                    elem.appendChild(document.createTextNode(", "));
-            }
-            elem.appendChild(document.createTextNode("]"));
+        InjectedScriptAccess.getProperties(arr, false, this._printArray.bind(this, elem));
+    },
+
+    _printArray: function(elem, properties)
+    {
+        if (!properties)
+            return;
+        var elements = [];
+        for (var i = 0; i < properties.length; ++i) {
+            var name = properties[i].name;
+            if (name == parseInt(name))
+                elements[name] = this._format(properties[i].value);
+        }
+
+        elem.appendChild(document.createTextNode("["));
+        for (var i = 0; i < elements.length; ++i) {
+            var element = elements[i];
+            if (element)
+                elem.appendChild(element);
+            else
+                elem.appendChild(document.createTextNode("undefined"))
+            if (i < elements.length - 1)
+                elem.appendChild(document.createTextNode(", "));
         }
-        InjectedScriptAccess.getProperties(arr, false, printResult);
+        elem.appendChild(document.createTextNode("]"));
     },
 
     _formatnode: function(object, elem)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
index f9604a4..9f9845c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
@@ -27,7 +27,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.CookieItemsView = function()
+WebInspector.CookieItemsView = function(cookieDomain)
 {
     WebInspector.View.call(this);
 
@@ -40,6 +40,8 @@ WebInspector.CookieItemsView = function()
 
     this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+    
+    this._cookieDomain = cookieDomain;
 }
 
 WebInspector.CookieItemsView.prototype = {
@@ -70,6 +72,7 @@ WebInspector.CookieItemsView.prototype = {
             if (dataGrid) {
                 self._dataGrid = dataGrid;
                 self.element.appendChild(dataGrid.element);
+                self._dataGrid.updateWidths();
                 if (isAdvanced)
                     self.deleteButton.visible = true;
             } else {
@@ -82,7 +85,7 @@ WebInspector.CookieItemsView.prototype = {
             }
         }
 
-        WebInspector.Cookies.getCookiesAsync(callback);
+        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
     },
 
     dataGridForCookies: function(cookies)
@@ -246,6 +249,12 @@ WebInspector.CookieItemsView.prototype = {
 
         return dataGrid;
     },
+    
+    resize: function()
+    {
+        if (this._dataGrid)
+            this._dataGrid.updateWidths();
+    },
 
     _deleteButtonClicked: function(event)
     {
@@ -253,7 +262,7 @@ WebInspector.CookieItemsView.prototype = {
             return;
 
         var cookie = this._dataGrid.selectedNode.cookie;
-        InspectorController.deleteCookie(cookie.name);
+        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
         this.update();
     },
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
index a151c05..25ffafa 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
@@ -307,13 +307,6 @@ WebInspector.DOMAgent = function() {
     this._window = new WebInspector.DOMWindow(this);
     this._idToDOMNode = null;
     this.document = null;
-
-    // TODO: update ElementsPanel to not track embedded iframes - it is already being handled
-    // in the agent backend.
-
-    // Whitespace is ignored in InspectorDOMAgent already -> no need to filter.
-    // TODO: Either remove all of its usages or push value into the agent backend.
-    Preferences.ignoreWhitespace = false;
 }
 
 WebInspector.DOMAgent.prototype = {
@@ -417,10 +410,8 @@ WebInspector.DOMAgent.prototype = {
         node._childNodeCount = newValue;
         var outline = WebInspector.panels.elements.treeOutline;
         var treeElement = outline.findTreeElement(node);
-        if (treeElement) {
+        if (treeElement)
             treeElement.hasChildren = newValue;
-            treeElement.whitespaceIgnored = Preferences.ignoreWhitespace;
-        }
     },
 
     _childNodeInserted: function(parentId, prevId, payload)
@@ -446,7 +437,7 @@ WebInspector.DOMAgent.prototype = {
 
 WebInspector.Cookies = {}
 
-WebInspector.Cookies.getCookiesAsync = function(callback)
+WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
 {
     function mycallback(cookies, cookiesString) {
         if (cookiesString)
@@ -455,7 +446,7 @@ WebInspector.Cookies.getCookiesAsync = function(callback)
             callback(cookies, true);
     }
     var callId = WebInspector.Callback.wrap(mycallback);
-    InspectorController.getCookies(callId);
+    InspectorController.getCookies(callId, cookieDomain);
 }
 
 WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
index dcab2ab..1a348fc 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
@@ -26,18 +26,18 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Database = function(database, domain, name, version)
+WebInspector.Database = function(id, domain, name, version)
 {
-    this._database = database;
-    this.domain = domain;
-    this.name = name;
-    this.version = version;
+    this._id = id;
+    this._domain = domain;
+    this._name = name;
+    this._version = version;
 }
 
 WebInspector.Database.prototype = {
-    isDatabase: function(db)
+    get id()
     {
-        return this._database === db;
+        return this._id;
     },
 
     get name()
@@ -47,8 +47,6 @@ WebInspector.Database.prototype = {
 
     set name(x)
     {
-        if (this._name === x)
-            return;
         this._name = x;
     },
 
@@ -59,8 +57,6 @@ WebInspector.Database.prototype = {
 
     set version(x)
     {
-        if (this._version === x)
-            return;
         this._version = x;
     },
 
@@ -71,8 +67,6 @@ WebInspector.Database.prototype = {
 
     set domain(x)
     {
-        if (this._domain === x)
-            return;
         this._domain = x;
     },
 
@@ -83,31 +77,26 @@ WebInspector.Database.prototype = {
 
     getTableNames: function(callback)
     {
-        var names = InspectorController.databaseTableNames(this._database);
-        function sortingCallback()
+        function sortingCallback(names)
         {
             callback(names.sort());
         }
-        setTimeout(sortingCallback, 0);
+        var callId = WebInspector.Callback.wrap(sortingCallback);
+        InspectorController.getDatabaseTableNames(callId, this._id);
     },
     
     executeSql: function(query, onSuccess, onError)
     {
-        function successCallback(tx, result)
+        function callback(result)
         {
+            if (!(result instanceof Array)) {
+                onError(result);
+                return;
+            }
             onSuccess(result);
         }
-
-        function errorCallback(tx, error)
-        {
-            onError(error);
-        }
-
-        var self = this;
-        function queryTransaction(tx)
-        {
-            tx.executeSql(query, null, InspectorController.wrapCallback(successCallback.bind(self)), InspectorController.wrapCallback(errorCallback.bind(self)));
-        }
-        this._database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(errorCallback.bind(this)));
+        InjectedScriptAccess.executeSql(this._id, query, callback);
     }
 }
+
+WebInspector.didGetDatabaseTableNames = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
index 1b61a7b..5d0e6d7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
@@ -60,7 +60,7 @@ WebInspector.ElementsPanel = function()
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.panel.nodeSearchButton.removeStyleClass("toggled-on");
+            this.panel.nodeSearchButton.toggled = false;
         }
         if (this._focusedDOMNode)
             InjectedScriptAccess.addInspectedNode(this._focusedDOMNode.id, function() {});
@@ -479,7 +479,7 @@ WebInspector.ElementsPanel.prototype = {
                 updatedParentTreeElements.push(parentNodeItem);
             }
 
-            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestor(this.focusedDOMNode, parent)))
+            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestorNode(this.focusedDOMNode, parent)))
                 updateBreadcrumbs = true;
         }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index d8c4d89..c4bd372 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -115,12 +115,12 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.appendChild(treeElement);
         } else {
             // FIXME: this could use findTreeElement to reuse a tree element if it already exists
-            var node = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(this.rootDOMNode) : this.rootDOMNode.firstChild);
+            var node = this.rootDOMNode.firstChild;
             while (node) {
                 treeElement = new WebInspector.ElementsTreeElement(node);
                 treeElement.selectable = this.selectEnabled;
                 this.appendChild(treeElement);
-                node = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+                node = node.nextSibling;
             }
         }
 
@@ -184,6 +184,34 @@ WebInspector.ElementsTreeOutline.prototype = {
 
         return element;
     },
+    
+    handleKeyEvent: function(event)
+    {
+        var selectedElement = this.selectedTreeElement;
+        if (!selectedElement)
+            return;
+
+        // Delete or backspace pressed, delete the node.
+        if (event.keyCode === 8 || event.keyCode === 46) {
+            selectedElement.remove();
+            return;
+        }
+
+        // On Enter or Return start editing the first attribute
+        // or create a new attribute on the selected element.
+        if (event.keyIdentifier === "Enter") {
+            if (this._editing)
+                return;
+
+            selectedElement._startEditing();
+
+            // prevent a newline from being immediately inserted
+            event.preventDefault();
+            return;
+        }
+
+        TreeOutline.prototype.handleKeyEvent.call(this, event);
+    },
 
     _onmousedown: function(event)
     {
@@ -197,12 +225,15 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     _onmousemove: function(event)
     {
+        var element = this._treeElementFromEvent(event);
+        if (element && this._previousHoveredElement === element)
+            return;
+
         if (this._previousHoveredElement) {
             this._previousHoveredElement.hovered = false;
             delete this._previousHoveredElement;
         }
 
-        var element = this._treeElementFromEvent(event);
         if (element && !element.elementCloseTag) {
             element.hovered = true;
             this._previousHoveredElement = element;
@@ -230,14 +261,10 @@ WebInspector.ElementsTreeOutline.prototype.__proto__ = TreeOutline.prototype;
 
 WebInspector.ElementsTreeElement = function(node)
 {
-    var hasChildren = Preferences.ignoreWhitespace ? (firstChildSkippingWhitespace.call(node) ? true : false) : node.hasChildNodes();
-    var titleInfo = nodeTitleInfo.call(node, hasChildren, WebInspector.linkifyURL);
-
-    if (titleInfo.hasChildren) 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
+    var hasChildrenOverride = node.hasChildNodes() && !this._showInlineText(node);
 
     // The title will be updated in onattach.
-    TreeElement.call(this, "", node, titleInfo.hasChildren);
+    TreeElement.call(this, "", node, hasChildrenOverride);
 
     if (this.representedObject.nodeType == Node.ELEMENT_NODE)
         this._canAddAttributes = true;
@@ -280,36 +307,39 @@ WebInspector.ElementsTreeElement.prototype = {
             if (x) {
                 this.updateSelection();
                 this.listItemElement.addStyleClass("hovered");
-            } else
+                if (this._canAddAttributes)
+                    this._pendingToggleNewAttribute = setTimeout(this.toggleNewAttributeButton.bind(this, true), 500);
+            } else {
                 this.listItemElement.removeStyleClass("hovered");
-            if (this._canAddAttributes)
-                this.toggleNewAttributeButton();
+                if (this._pendingToggleNewAttribute) {
+                    clearTimeout(this._pendingToggleNewAttribute);
+                    delete this._pendingToggleNewAttribute;
+                }
+                this.toggleNewAttributeButton(false);
+            }
         }
     },
 
-    toggleNewAttributeButton: function()
+    toggleNewAttributeButton: function(visible)
     {
-        function removeWhenEditing(event)
+        function removeAddAttributeSpan()
         {
             if (this._addAttributeElement && this._addAttributeElement.parentNode)
                 this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
             delete this._addAttributeElement;
         }
 
-        if (!this._addAttributeElement && this._hovered && !this._editing) {
+        if (!this._addAttributeElement && visible && !this._editing) {
             var span = document.createElement("span");
-            span.className = "add-attribute";
-            span.textContent = "\u2026";
-            span.addEventListener("dblclick", removeWhenEditing.bind(this), false);
+            span.className = "add-attribute webkit-html-attribute-name";
+            span.textContent = " ?=\"\"";
+            span.addEventListener("dblclick", removeAddAttributeSpan.bind(this), false);
             this._addAttributeElement = span;
 
             var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
             this._insertInLastAttributePosition(tag, span);
-        } else if (!this._hovered && this._addAttributeElement) {
-            if (this._addAttributeElement.parentNode)
-                this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
-            delete this._addAttributeElement;
-        }
+        } else if (!visible && this._addAttributeElement)
+            removeAddAttributeSpan.call(this);
     },
     
     updateSelection: function()
@@ -362,11 +392,9 @@ WebInspector.ElementsTreeElement.prototype = {
 
     onpopulate: function()
     {
-        if (this.children.length || this.whitespaceIgnored !== Preferences.ignoreWhitespace)
+        if (this.children.length || this._showInlineText(this.representedObject))
             return;
 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
-
         this.updateChildren();
     },
     
@@ -390,7 +418,7 @@ WebInspector.ElementsTreeElement.prototype = {
         function updateChildrenOfNode(node)
         {
             var treeOutline = treeElement.treeOutline;
-            var child = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(node) : node.firstChild);
+            var child = node.firstChild;
             while (child) {
                 var currentTreeElement = treeElement.children[treeChildIndex];
                 if (!currentTreeElement || currentTreeElement.representedObject !== child) {
@@ -418,7 +446,7 @@ WebInspector.ElementsTreeElement.prototype = {
                     }
                 }
 
-                child = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(child) : child.nextSibling;
+                child = child.nextSibling;
                 ++treeChildIndex;
             }
         }
@@ -491,7 +519,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this._editing)
             return;
 
-        if (this._startEditing(event, treeElement))
+        if (this._startEditingFromEvent(event, treeElement))
             return;
 
         if (this.treeOutline.panel) {
@@ -516,7 +544,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
-    _startEditing: function(event, treeElement)
+    _startEditingFromEvent: function(event, treeElement)
     {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
@@ -539,6 +567,30 @@ WebInspector.ElementsTreeElement.prototype = {
         return false;
     },
 
+    _startEditing: function()
+    {
+        if (this.treeOutline.focusedDOMNode !== this.representedObject)
+            return;
+
+        var listItem = this._listItemNode;
+
+        if (this._canAddAttributes) {
+            this.toggleNewAttributeButton(false);
+            var attribute = listItem.getElementsByClassName("webkit-html-attribute")[0];
+            if (attribute)
+                return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-name")[0]);
+
+            return this._addNewAttribute(listItem);
+        }
+
+        if (this.representedObject.nodeType === Node.TEXT_NODE) {
+            var textNode = listItem.getElementsByClassName("webkit-html-text-node")[0];
+            if (textNode)
+                return this._startEditingTextNode(textNode);
+            return;
+        }
+    },
+
     _addNewAttribute: function(listItemElement)
     {
         var attr = document.createElement("span");
@@ -646,7 +698,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 }
             }
 
-            if (!found && moveDirection === "backward")
+            if (!found && moveDirection === "backward" && attributes.length > 0)
                 moveToAttribute = attributes[attributes.length - 1].name;
             else if (!found && moveDirection === "forward" && !/^\s*$/.test(newText))
                 newAttribute = true;
@@ -720,12 +772,138 @@ WebInspector.ElementsTreeElement.prototype = {
 
     _updateTitle: function()
     {
-        var title = nodeTitleInfo.call(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
+        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
         this.title = "<span class=\"highlight\">" + title + "</span>";
         delete this.selectionElement;
         this.updateSelection();
         this._preventFollowingLinksOnDoubleClick();
     },
+
+    _nodeTitleInfo: function(node, hasChildren, linkify)
+    {
+        var info = {title: "", hasChildren: hasChildren};
+        
+        switch (node.nodeType) {
+            case Node.DOCUMENT_NODE:
+                info.title = "Document";
+                break;
+                
+            case Node.ELEMENT_NODE:
+                info.title = "<span class=\"webkit-html-tag\">&lt;" + node.nodeName.toLowerCase().escapeHTML();
+                
+                if (node.hasAttributes()) {
+                    for (var i = 0; i < node.attributes.length; ++i) {
+                        var attr = node.attributes[i];
+                        info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
+                        
+                        var value = attr.value;
+                        if (linkify && (attr.name === "src" || attr.name === "href")) {
+                            var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
+                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                        } else {
+                            var value = value.escapeHTML();
+                            value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
+                            info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
+                        }
+                        info.title += "\"</span>";
+                    }
+                }
+                info.title += "&gt;</span>&#8203;";
+                
+                // If this element only has a single child that is a text node,
+                // just show that text and the closing tag inline rather than
+                // create a subtree for them
+                
+                var textChild = onlyTextChild.call(node);
+                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+                
+                if (showInlineText) {
+                    info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + node.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
+                    info.hasChildren = false;
+                }
+                break;
+                
+            case Node.TEXT_NODE:
+                if (isNodeWhitespace.call(node))
+                    info.title = "(whitespace)";
+                else {
+                    if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "script") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
+                        javascriptSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "style") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
+                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else {
+                        info.title = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue.escapeHTML() + "</span>\""; 
+                    }
+                } 
+                break;
+                
+            case Node.COMMENT_NODE:
+                info.title = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue.escapeHTML() + "--&gt;</span>";
+                break;
+                
+            case Node.DOCUMENT_TYPE_NODE:
+                info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName;
+                if (node.publicId) {
+                    info.title += " PUBLIC \"" + node.publicId + "\"";
+                    if (node.systemId)
+                        info.title += " \"" + node.systemId + "\"";
+                } else if (node.systemId)
+                    info.title += " SYSTEM \"" + node.systemId + "\"";
+                if (node.internalSubset)
+                    info.title += " [" + node.internalSubset + "]";
+                info.title += "&gt;</span>";
+                break;
+            default:
+                info.title = node.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
+        }
+        
+        return info;
+    },
+
+    _showInlineText: function(node)
+    {
+        if (node.nodeType === Node.ELEMENT_NODE) {
+            var textChild = onlyTextChild.call(node);
+            if (textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength)
+                return true;
+        }
+        return false;
+    },
+    
+    remove: function()
+    {
+        var parentElement = this.parent;
+        if (!parentElement)
+            return;
+
+        var self = this;
+        function removeNodeCallback(removedNodeId)
+        {
+            // -1 is an error code, which means removing the node from the DOM failed,
+            // so we shouldn't remove it from the tree.
+            if (removedNodeId === -1)
+                return;
+
+            parentElement.removeChild(self);
+        }
+
+        var callId = WebInspector.Callback.wrap(removeNodeCallback);
+        InspectorController.removeNode(callId, this.representedObject.id);
+    }
 }
 
 WebInspector.ElementsTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+WebInspector.didRemoveNode = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
index 87293b8..3ce96d0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
@@ -41,9 +41,12 @@ InjectedScript.reset = function()
 
 InjectedScript.reset();
 
-InjectedScript.dispatch = function(methodName, args)
+InjectedScript.dispatch = function(methodName, args, callId)
 {
-    var result = InjectedScript[methodName].apply(InjectedScript, JSON.parse(args));
+    var argsArray = JSON.parse(args);
+    if (callId)
+        argsArray.splice(0, 0, callId);  // Methods that run asynchronously have a call back id parameter.
+    var result = InjectedScript[methodName].apply(InjectedScript, argsArray);
     if (typeof result === "undefined") {
         InjectedScript._window().console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
         result = null;
@@ -514,12 +517,28 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
             var callFrame = InjectedScript._callFrameForId(callFrameId);
             if (!callFrame)
                 return props;
-            expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+            if (expression)
+                expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+            else {
+                // Evaluate into properties in scope of the selected call frame.
+                var scopeChain = callFrame.scopeChain;
+                for (var i = 0; i < scopeChain.length; ++i) {
+                    var scopeObject = scopeChain[i];
+                    try {
+                        for (var propertyName in scopeObject)
+                            props[propertyName] = true;
+                    } catch (e) {
+                    }
+                }
+            }
         } else {
+            if (!expression)
+                expression = "this";
             expressionResult = InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
         }
-        for (var prop in expressionResult)
-            props[prop] = true;
+        if (expressionResult)
+            for (var prop in expressionResult)
+                props[prop] = true;
         if (includeInspectorCommandLineAPI)
             for (var prop in InjectedScript._window()._inspectorCommandLineAPI)
                 if (prop.charAt(0) !== '_')
@@ -529,16 +548,16 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
     return props;
 }
 
-InjectedScript.evaluate = function(expression)
+InjectedScript.evaluate = function(expression, objectGroup)
 {
-    return InjectedScript._evaluateAndWrap(InjectedScript._window().eval, InjectedScript._window(), expression);
+    return InjectedScript._evaluateAndWrap(InjectedScript._window().eval, InjectedScript._window(), expression, objectGroup);
 }
 
-InjectedScript._evaluateAndWrap = function(evalFunction, object, expression)
+InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, objectGroup)
 {
     var result = {};
     try {
-        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression));
+        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
         // Handle error that might have happened while describing result.
         if (result.value.errorText) {
             result.value = result.value.errorText;
@@ -553,7 +572,7 @@ InjectedScript._evaluateAndWrap = function(evalFunction, object, expression)
 
 InjectedScript._evaluateOn = function(evalFunction, object, expression)
 {
-    InjectedScript._ensureCommandLineAPIInstalled();
+    InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
     expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
@@ -572,7 +591,7 @@ InjectedScript.addInspectedNode = function(nodeId)
     if (!node)
         return false;
 
-    InjectedScript._ensureCommandLineAPIInstalled();
+    InjectedScript._ensureCommandLineAPIInstalled(InjectedScript._window().eval, InjectedScript._window());
     var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
     inspectedNodes.unshift(node);
     if (inspectedNodes.length >= 5)
@@ -838,12 +857,12 @@ InjectedScript.getCallFrames = function()
     return result;
 }
 
-InjectedScript.evaluateInCallFrame = function(callFrameId, code)
+InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
 {
     var callFrame = InjectedScript._callFrameForId(callFrameId);
     if (!callFrame)
         return false;
-    return InjectedScript._evaluateAndWrap(callFrame.evaluate, callFrame, code);
+    return InjectedScript._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup);
 }
 
 InjectedScript._callFrameForId = function(id)
@@ -880,13 +899,11 @@ InjectedScript._inspectObject = function(o)
     }
 }
 
-InjectedScript._ensureCommandLineAPIInstalled = function(inspectedWindow)
+InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
-    var inspectedWindow = InjectedScript._window();
-    if (inspectedWindow._inspectorCommandLineAPI)
+    if (evalFunction.call(evalObject, "window._inspectorCommandLineAPI"))
         return;
-    
-    inspectedWindow.eval("window._inspectorCommandLineAPI = { \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window._inspectorCommandLineAPI = { \
         $: function() { return document.getElementById.apply(document, arguments) }, \
         $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
         $x: function(xpath, context) { \
@@ -913,8 +930,8 @@ InjectedScript._ensureCommandLineAPIInstalled = function(inspectedWindow)
         get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
     };");
 
-    inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
-    inspectedWindow._inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
 }
 
 InjectedScript._resolveObject = function(objectProxy)
@@ -1031,18 +1048,51 @@ InjectedScript.CallFrameProxy.prototype = {
                 scopeObjectProxy.isDocument = true;
             else if (!foundLocalScope)
                 scopeObjectProxy.isWithBlock = true;
-            scopeObjectProxy.properties = [];
-            try {
-                for (var propertyName in scopeObject)
-                    scopeObjectProxy.properties.push(propertyName);
-            } catch (e) {
-            }
             scopeChainProxy.push(scopeObjectProxy);
         }
         return scopeChainProxy;
     }
 }
 
+InjectedScript.executeSql = function(callId, databaseId, query)
+{
+    function successCallback(tx, result)
+    {
+        var rows = result.rows;
+        var result = [];
+        var length = rows.length;
+        for (var i = 0; i < length; ++i) {
+            var data = {};
+            result.push(data);
+            var row = rows.item(i);
+            for (var columnIdentifier in row) {
+                // FIXME: (Bug 19439) We should specially format SQL NULL here
+                // (which is represented by JavaScript null here, and turned
+                // into the string "null" by the String() function).
+                var text = row[columnIdentifier];
+                data[columnIdentifier] = String(text);
+            }
+        }
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+    }
+
+    function errorCallback(tx, error)
+    {
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+    }
+
+    function queryTransaction(tx)
+    {
+        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+    }
+
+    var database = InspectorController.databaseForId(databaseId);
+    if (!database)
+        errorCallback(null, { code : 2 });  // Return as unexpected version.
+    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    return true;
+}
+
 Object.type = function(obj)
 {
     if (obj === null)
@@ -1068,6 +1118,8 @@ Object.type = function(obj)
         return "date";
     if (obj instanceof win.RegExp)
         return "regexp";
+    if (obj instanceof win.NodeList)
+        return "array";
     if (obj instanceof win.Error)
         return "error";
     return type;
@@ -1090,9 +1142,8 @@ Object.describe = function(obj, abbreviated)
     switch (type1) {
     case "object":
     case "node":
-        return type2;
     case "array":
-        return "[" + obj.toString() + "]";
+        return type2;
     case "string":
         if (!abbreviated)
             return obj;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
index 67312f7..c6d4b65 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -31,7 +31,7 @@
 
 var InjectedScriptAccess = {};
 
-InjectedScriptAccess._installHandler = function(methodName)
+InjectedScriptAccess._installHandler = function(methodName, async)
 {
     InjectedScriptAccess[methodName] = function()
     {
@@ -47,35 +47,37 @@ InjectedScriptAccess._installHandler = function(methodName)
                 WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
         }
         var callId = WebInspector.Callback.wrap(myCallback);
-        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString);
+        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
     };
 }
 
 // InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
 // - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
 // - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
-InjectedScriptAccess._installHandler("getStyles");
+// We keep these sorted.
+InjectedScriptAccess._installHandler("addInspectedNode");
+InjectedScriptAccess._installHandler("addStyleSelector");
+InjectedScriptAccess._installHandler("applyStyleRuleText");
+InjectedScriptAccess._installHandler("applyStyleText");
+InjectedScriptAccess._installHandler("evaluate");
+InjectedScriptAccess._installHandler("evaluateInCallFrame");
+InjectedScriptAccess._installHandler("getCompletions");
 InjectedScriptAccess._installHandler("getComputedStyle");
 InjectedScriptAccess._installHandler("getInlineStyle");
-InjectedScriptAccess._installHandler("applyStyleText");
-InjectedScriptAccess._installHandler("setStyleText");
-InjectedScriptAccess._installHandler("toggleStyleEnabled");
-InjectedScriptAccess._installHandler("applyStyleRuleText");
-InjectedScriptAccess._installHandler("addStyleSelector");
-InjectedScriptAccess._installHandler("setStyleProperty");
-InjectedScriptAccess._installHandler("getPrototypes");
 InjectedScriptAccess._installHandler("getProperties");
-InjectedScriptAccess._installHandler("setPropertyValue");
-InjectedScriptAccess._installHandler("getCompletions");
-InjectedScriptAccess._installHandler("evaluate");
-InjectedScriptAccess._installHandler("addInspectedNode");
-InjectedScriptAccess._installHandler("pushNodeToFrontend");
-InjectedScriptAccess._installHandler("evaluate");
-InjectedScriptAccess._installHandler("addInspectedNode");
-InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("getPrototypes");
+InjectedScriptAccess._installHandler("getStyles");
+InjectedScriptAccess._installHandler("openInInspectedWindow");
 InjectedScriptAccess._installHandler("performSearch");
+InjectedScriptAccess._installHandler("pushNodeToFrontend");
 InjectedScriptAccess._installHandler("searchCanceled");
-InjectedScriptAccess._installHandler("openInInspectedWindow");
-InjectedScriptAccess._installHandler("evaluateInCallFrame");
+InjectedScriptAccess._installHandler("setPropertyValue");
+InjectedScriptAccess._installHandler("setStyleProperty");
+InjectedScriptAccess._installHandler("setStyleText");
+InjectedScriptAccess._installHandler("toggleStyleEnabled");
+
+// Some methods can't run synchronously even on the injected script side (such as DB transactions).
+// Mark them as asynchronous here.
+InjectedScriptAccess._installHandler("executeSql", true);
 
 WebInspector.didDispatchOnInjectedScript = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js
index 80202b0..74fb56e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Object.js
@@ -67,10 +67,10 @@ WebInspector.Object.prototype = {
         }
 
         var event = {target: this, type: eventType, defaultPrevented: false};
-        event.stopPropagation = stopPropagation.bind(event);
-        event.preventDefault = preventDefault.bind(event);
+        event.stopPropagation = stopPropagation;
+        event.preventDefault = preventDefault;
 
-        var listeners = this._listeners[eventType];
+        var listeners = this._listeners[eventType].slice(0);
         for (var i = 0; i < listeners.length; ++i) {
             listeners[i].listener.call(listeners[i].thisObject, event);
             if (stoppedPropagation)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index 2b8c6ce..ee96345 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -23,7 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ProfileView = function(profile)
+// FIXME: Rename the file.
+
+WebInspector.CPUProfileView = function(profile)
 {
     WebInspector.View.call(this);
 
@@ -78,15 +80,25 @@ WebInspector.ProfileView = function(profile)
 
     this.profile = profile;
 
-    this.profileDataGridTree = this.bottomUpProfileDataGridTree;
-    this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
-
-    this.refresh();
+    var self = this;
+    function profileCallback(profile)
+    {
+        self.profile.representedObject = profile;
+        self._assignParentsInProfile();
+      
+        self.profileDataGridTree = self.bottomUpProfileDataGridTree;
+        self.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
+     
+        self.refresh();
+     
+        self._updatePercentButton();
+    }
 
-    this._updatePercentButton();
+    var callId = WebInspector.Callback.wrap(profileCallback);
+    InspectorController.getProfile(callId, this.profile.uid);
 }
 
-WebInspector.ProfileView.prototype = {
+WebInspector.CPUProfileView.prototype = {
     get statusBarItems()
     {
         return [this.viewSelectElement, this.percentButton.element, this.focusButton.element, this.excludeButton.element, this.resetButton.element];
@@ -158,7 +170,7 @@ WebInspector.ProfileView.prototype = {
         WebInspector.View.prototype.hide.call(this);
         this._currentSearchResultIndex = -1;
     },
-    
+
     resize: function()
     {
         if (this.dataGrid)
@@ -493,7 +505,7 @@ WebInspector.ProfileView.prototype = {
 
     _sortData: function(event)
     {
-        this._sortProfile(this.profile);
+        this._sortProfile(this.profile.representedObject);
     },
 
     _sortProfile: function()
@@ -533,7 +545,100 @@ WebInspector.ProfileView.prototype = {
 
         event.preventDefault();
         event.stopPropagation();
+    },
+
+    _assignParentsInProfile: function()
+    {
+        var head = this.profile.head;
+        head.parent = null;
+        head.head = null;
+        var nodesToTraverse = [ { parent: head, children: head.children } ];
+        while (nodesToTraverse.length > 0) {
+            var pair = nodesToTraverse.shift();
+            var parent = pair.parent;
+            var children = pair.children;
+            var length = children.length;
+            for (var i = 0; i < length; ++i) {
+                children[i].head = head;
+                children[i].parent = parent;
+                if (children[i].children.length > 0)
+                    nodesToTraverse.push({ parent: children[i], children: children[i].children });
+            }
+        }
+    }
+}
+
+WebInspector.CPUProfileView.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.CPUProfileType = function()
+{
+    WebInspector.ProfileType.call(this, WebInspector.CPUProfileType.TypeId, WebInspector.UIString("CPU PROFILES"));
+    this._recording = false;
+}
+
+WebInspector.CPUProfileType.TypeId = "CPU";
+
+WebInspector.CPUProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return this._recording ? WebInspector.UIString("Stop profiling.") : WebInspector.UIString("Start profiling.");
+    },
+
+    get buttonStyle()
+    {
+        return this._recording ? "record-profile-status-bar-item status-bar-item toggled-on" : "record-profile-status-bar-item status-bar-item";
+    },
+
+    buttonClicked: function()
+    {
+        this._recording = !this._recording;
+
+        if (this._recording)
+            InspectorController.startProfiling();
+        else
+            InspectorController.stopProfiling();
+    },
+
+    setRecordingProfile: function(isProfiling)
+    {
+        this._recording = isProfiling;
     }
 }
 
-WebInspector.ProfileView.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.CPUProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
+
+WebInspector.CPUProfile = function(profile)
+{
+    this.representedObject = profile;
+    this.typeId = WebInspector.CPUProfileType.TypeId;
+}
+
+WebInspector.CPUProfile.prototype = {
+    get title()
+    {
+        return this.representedObject.title;
+    },
+
+    get uid()
+    {
+        return this.representedObject.uid;
+    },
+
+    get head()
+    {
+        return this.representedObject.head;
+    },
+
+    createView: function()
+    {
+        return new WebInspector.CPUProfileView(this);
+    },
+
+    // FIXME: Extract this into a superclass so that createView can be simply overridden by subclasses.
+    viewForProfile: function()
+    {
+        if (!this._profileView)
+            this._profileView = this.createView();
+        return this._profileView;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index 3bd4464..55e286e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -25,11 +25,52 @@
 
 const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
 
+WebInspector.ProfileType = function(id, name)
+{
+    this._id = id;
+    this._name = name;
+}
+
+WebInspector.ProfileType.URLRegExp = /webkit-profile:\/\/(.+)\/(.+)#([0-9]+)/;
+
+WebInspector.ProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return "";
+    },
+
+    get buttonStyle()
+    {
+        return undefined;
+    },
+
+    get buttonCaption()
+    {
+        return this.name;
+    },
+
+    get id()
+    {
+        return this._id;
+    },
+
+    get name()
+    {
+        return this._name;
+    },
+
+    buttonClicked: function()
+    {
+    }
+}
+
 WebInspector.ProfilesPanel = function()
 {
     WebInspector.Panel.call(this);
 
     this.element.addStyleClass("profiles");
+    this._profileTypesByIdMap = {};
+    this._profileTypeButtonsByIdMap = {};
 
     var panelEnablerHeading = WebInspector.UIString("You need to enable profiling before you can use the Profiles panel.");
     var panelEnablerDisclaimer = WebInspector.UIString("Enabling profiling will make scripts run slower.");
@@ -52,19 +93,8 @@ WebInspector.ProfilesPanel = function()
     this.sidebarTreeElement = document.createElement("ol");
     this.sidebarTreeElement.className = "sidebar-tree";
     this.sidebarElement.appendChild(this.sidebarTreeElement);
-
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
-    this.profilesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("CPU PROFILES"), null, true);
-    this.sidebarTree.appendChild(this.profilesListTreeElement);
-    this.profilesListTreeElement.expand();
-
-    this.snapshotsListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("HEAP SNAPSHOTS"), null, true);
-    if (Preferences.heapProfilerPresent) {
-        this.sidebarTree.appendChild(this.snapshotsListTreeElement);
-        this.snapshotsListTreeElement.expand();
-    }
-
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
@@ -72,18 +102,10 @@ WebInspector.ProfilesPanel = function()
     this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.recordButton = new WebInspector.StatusBarButton(WebInspector.UIString("Start profiling."), "record-profile-status-bar-item");
-    this.recordButton.addEventListener("click", this._recordClicked.bind(this), false);
-
-    this.recording = false;
-
-    this.snapshotButton = new WebInspector.StatusBarButton(WebInspector.UIString("Take heap snapshot."), "heap-snapshot-status-bar-item");
-    this.snapshotButton.visible = Preferences.heapProfilerPresent;
-    this.snapshotButton.addEventListener("click", this._snapshotClicked.bind(this), false);
-
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
+    this._profiles = [];
     this.reset();
 }
 
@@ -97,7 +119,25 @@ WebInspector.ProfilesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton.element, this.recordButton.element, this.snapshotButton.element, this.profileViewStatusBarItemsContainer];
+        function clickHandler(profileType, buttonElement)
+        {
+            profileType.buttonClicked.call(profileType);
+            this.updateProfileTypeButtons();
+        }
+
+        var items = [this.enableToggleButton.element];
+        // FIXME: Generate a single "combo-button".
+        for (var typeId in this._profileTypesByIdMap) {
+            var profileType = this.getProfileType(typeId);
+            if (profileType.buttonStyle) {
+                var button = new WebInspector.StatusBarButton(profileType.buttonTooltip, profileType.buttonStyle, profileType.buttonCaption);
+                this._profileTypeButtonsByIdMap[typeId] = button.element;
+                button.element.addEventListener("click", clickHandler.bind(this, profileType, button.element), false);
+                items.push(button.element);
+            }
+        }
+        items.push(this.profileViewStatusBarItemsContainer);
+        return items;
     },
 
     show: function()
@@ -129,13 +169,8 @@ WebInspector.ProfilesPanel.prototype = {
 
     reset: function()
     {
-        if (this._profiles) {
-            var profiledLength = this._profiles.length;
-            for (var i = 0; i < profiledLength; ++i) {
-                var profile = this._profiles[i];
-                delete profile._profileView;
-            }
-        }
+        for (var i = 0; i < this._profiles.length; ++i)
+            delete this._profiles[i]._profileView;
 
         delete this.currentQuery;
         this.searchCanceled();
@@ -147,8 +182,9 @@ WebInspector.ProfilesPanel.prototype = {
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
 
-        this.profilesListTreeElement.removeChildren();
-        this.snapshotsListTreeElement.removeChildren();
+        for (var typeId in this._profileTypesByIdMap)
+            this.getProfileType(typeId).treeElement.removeChildren();
+
         this.profileViews.removeChildren();
 
         this.profileViewStatusBarItemsContainer.removeChildren();
@@ -161,20 +197,34 @@ WebInspector.ProfilesPanel.prototype = {
         this.sidebarTree.handleKeyEvent(event);
     },
 
-    addProfile: function(profile)
+    registerProfileType: function(profileType)
     {
-        this._profiles.push(profile);
-        this._profilesIdMap[profile.uid] = profile;
+        this._profileTypesByIdMap[profileType.id] = profileType;
+        profileType.treeElement = new WebInspector.SidebarSectionTreeElement(profileType.name, null, true);
+        this.sidebarTree.appendChild(profileType.treeElement);
+        profileType.treeElement.expand();
+    },
+
+    _makeKey: function(text, profileTypeId)
+    {
+        return escape(text) + '/' + escape(profileTypeId);
+    },
 
-        var sidebarParent = this.profilesListTreeElement;
+    addProfileHeader: function(typeId, profile)
+    {
+        var sidebarParent = this.getProfileType(typeId).treeElement;
         var small = false;
         var alternateTitle;
 
+        this._profiles.push(profile);
+        this._profilesIdMap[this._makeKey(profile.uid, typeId)] = profile;
+
         if (profile.title.indexOf(UserInitiatedProfileName) !== 0) {
-            if (!(profile.title in this._profileGroups))
-                this._profileGroups[profile.title] = [];
+            var profileTitleKey = this._makeKey(profile.title, typeId);
+            if (!(profileTitleKey in this._profileGroups))
+                this._profileGroups[profileTitleKey] = [];
 
-            var group = this._profileGroups[profile.title];
+            var group = this._profileGroups[profileTitleKey];
             group.push(profile);
 
             if (group.length === 2) {
@@ -182,12 +232,12 @@ WebInspector.ProfilesPanel.prototype = {
                 group._profilesTreeElement = new WebInspector.ProfileGroupSidebarTreeElement(profile.title);
 
                 // Insert at the same index for the first profile of the group.
-                var index = this.sidebarTree.children.indexOf(group[0]._profilesTreeElement);
-                this.sidebarTree.insertChild(group._profilesTreeElement, index);
+                var index = sidebarParent.children.indexOf(group[0]._profilesTreeElement);
+                sidebarParent.insertChild(group._profilesTreeElement, index);
 
                 // Move the first profile to the group.
                 var selected = group[0]._profilesTreeElement.selected;
-                this.sidebarTree.removeChild(group[0]._profilesTreeElement);
+                sidebarParent.removeChild(group[0]._profilesTreeElement);
                 group._profilesTreeElement.appendChild(group[0]._profilesTreeElement);
                 if (selected) {
                     group[0]._profilesTreeElement.select();
@@ -214,6 +264,8 @@ WebInspector.ProfilesPanel.prototype = {
         profile._profilesTreeElement = profileTreeElement;
 
         sidebarParent.appendChild(profileTreeElement);
+        if (!this.visibleView)
+            this.showProfile(profile);
     },
 
     showProfile: function(profile)
@@ -224,7 +276,7 @@ WebInspector.ProfilesPanel.prototype = {
         if (this.visibleView)
             this.visibleView.hide();
 
-        var view = this.profileViewForProfile(profile);
+        var view = profile.viewForProfile();
 
         view.show(this.profileViews);
 
@@ -245,18 +297,28 @@ WebInspector.ProfilesPanel.prototype = {
         this.showProfile(view.profile);
     },
 
-    profileViewForProfile: function(profile)
+    getProfileType: function(typeId)
     {
-        if (!profile)
-            return null;
-        if (!profile._profileView)
-            profile._profileView = new WebInspector.ProfileView(profile);
-        return profile._profileView;
+        return this._profileTypesByIdMap[typeId];
     },
 
-    showProfileById: function(uid)
+    showProfileForURL: function(url)
     {
-        this.showProfile(this._profilesIdMap[uid]);
+        var match = url.match(WebInspector.ProfileType.URLRegExp);
+        if (!match)
+            return;
+        this.showProfile(this._profilesIdMap[this._makeKey(match[3], match[1])]);
+    },
+
+    updateProfileTypeButtons: function()
+    {
+        for (var typeId in this._profileTypeButtonsByIdMap) {
+            var buttonElement = this._profileTypeButtonsByIdMap[typeId];
+            var profileType = this.getProfileType(typeId);
+            buttonElement.className = profileType.buttonStyle;
+            buttonElement.title = profileType.buttonTooltip;
+            // FIXME: Apply profileType.buttonCaption once captions are added to button controls.
+        }
     },
 
     closeVisibleView: function()
@@ -266,16 +328,17 @@ WebInspector.ProfilesPanel.prototype = {
         delete this.visibleView;
     },
 
-    displayTitleForProfileLink: function(title)
+    displayTitleForProfileLink: function(title, typeId)
     {
         title = unescape(title);
         if (title.indexOf(UserInitiatedProfileName) === 0) {
             title = WebInspector.UIString("Profile %d", title.substring(UserInitiatedProfileName.length + 1));
         } else {
-            if (!(title in this._profileGroupsForLinks))
-                this._profileGroupsForLinks[title] = 0;
+            var titleKey = this._makeKey(title, typeId);
+            if (!(titleKey in this._profileGroupsForLinks))
+                this._profileGroupsForLinks[titleKey] = 0;
 
-            groupNumber = ++this._profileGroupsForLinks[title];
+            groupNumber = ++this._profileGroupsForLinks[titleKey];
 
             if (groupNumber > 2)
                 // The title is used in the console message announcing that a profile has started so it gets
@@ -296,7 +359,7 @@ WebInspector.ProfilesPanel.prototype = {
 
         var profilesLength = this._profiles.length;
         for (var i = 0; i < profilesLength; ++i) {
-            var view = this.profileViewForProfile(this._profiles[i]);
+            var view = this._profiles[i].viewForProfile();
             if (!view.performSearch || view === visibleView)
                 continue;
             views.push(view);
@@ -323,19 +386,6 @@ WebInspector.ProfilesPanel.prototype = {
         }
     },
 
-    setRecordingProfile: function(isProfiling)
-    {
-        this.recording = isProfiling;
-
-        if (isProfiling) {
-            this.recordButton.toggled = true;
-            this.recordButton.title = WebInspector.UIString("Stop profiling.");
-        } else {
-            this.recordButton.toggled = false;
-            this.recordButton.title = WebInspector.UIString("Start profiling.");
-        }
-    },
-    
     resize: function()
     {
         var visibleView = this.visibleView;
@@ -345,39 +395,24 @@ WebInspector.ProfilesPanel.prototype = {
 
     _updateInterface: function()
     {
+        // FIXME: Replace ProfileType-specific button visibility changes by a single ProfileType-agnostic "combo-button" visibility change.
         if (InspectorController.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
-            this.recordButton.visible = true;
-            if (Preferences.heapProfilerPresent)
-                this.snapshotButton.visible = true;
+            for (var typeId in this._profileTypeButtonsByIdMap)
+                this._profileTypeButtonsByIdMap[typeId].removeStyleClass("hidden");
             this.profileViewStatusBarItemsContainer.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Profiling disabled. Click to enable.");
             this.enableToggleButton.toggled = false;
-            this.recordButton.visible = false;
-            this.snapshotButton.visible = false;
+            for (var typeId in this._profileTypeButtonsByIdMap)
+                this._profileTypeButtonsByIdMap[typeId].addStyleClass("hidden");
             this.profileViewStatusBarItemsContainer.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
     },
 
-    _recordClicked: function()
-    {
-        this.recording = !this.recording;
-
-        if (this.recording)
-            InspectorController.startProfiling();
-        else
-            InspectorController.stopProfiling();
-    },
-
-    _snapshotClicked: function()
-    {
-        InspectorController.takeHeapSnapshot();
-    },
-
     _enableProfiling: function()
     {
         if (InspectorController.profilerEnabled())
@@ -397,19 +432,19 @@ WebInspector.ProfilesPanel.prototype = {
     {
         // FIXME: This code needs to be adjusted when more profiling types are added.
         // Currently defaults to CPU profiles.
-        var cpuProfiles = this.sidebarTree.children[0];
+        var cpuProfiles = this.getProfileType(WebInspector.CPUProfileType.TypeId).treeElement;
         if (cpuProfiles.children.length)
             return;
 
-        var profiles = InspectorController.profiles();
-        var profilesLength = profiles.length;
-        for (var i = 0; i < profilesLength; ++i) {
-            var profile = profiles[i];
-            this.addProfile(profile);
+        function populateCallback(profileHeaders) {
+            profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
+            var profileHeadersLength = profileHeaders.length;
+            for (var i = 0; i < profileHeadersLength; ++i)
+                WebInspector.addProfileHeader(profileHeaders[i]);
         }
 
-        if (cpuProfiles.children[0])
-            cpuProfiles.children[0].select();
+        var callId = WebInspector.Callback.wrap(populateCallback);
+        InspectorController.getProfileHeaders(callId);
 
         delete this._shouldPopulateProfiles;
     },
@@ -535,3 +570,6 @@ WebInspector.ProfileGroupSidebarTreeElement.prototype = {
 }
 
 WebInspector.ProfileGroupSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.didGetProfileHeaders = WebInspector.Callback.processCallback;
+WebInspector.didGetProfile = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
index 4fcc956..28586f6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
@@ -197,6 +197,7 @@ WebInspector.ResourceView.prototype = {
         var title = "<div class=\"header-name\">&nbsp;</div>";
         title += "<div class=\"raw-form-data header-value\">" + formData.escapeHTML() + "</div>";
         var parmTreeElement = new TreeElement(title, null, false);
+        parmTreeElement.selectable = false;
         this.requestPayloadTreeElement.appendChild(parmTreeElement);
     },
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index 2c96974..0f873e7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -71,6 +71,10 @@ WebInspector.ResourcesPanel = function()
     this.dividersElement = document.createElement("div");
     this.dividersElement.id = "resources-dividers";
     this.containerContentElement.appendChild(this.dividersElement);
+    
+    this.eventDividersElement = document.createElement("div");
+    this.eventDividersElement.id = "resources-event-dividers";
+    this.containerContentElement.appendChild(this.eventDividersElement);
 
     this.dividersLabelBarElement = document.createElement("div");
     this.dividersLabelBarElement.id = "resources-dividers-label-bar";
@@ -133,8 +137,12 @@ WebInspector.ResourcesPanel = function()
     this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
 
     this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
-    this.largerResourcesButton.toggled = true;
+    this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
     this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
+    if (!Preferences.resourcesLargeRows) {
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        this._toggleLargerResources(); // this will toggle the preference back to the original
+    }
 
     this.sortingSelectElement = document.createElement("select");
     this.sortingSelectElement.className = "status-bar-item";
@@ -204,6 +212,37 @@ WebInspector.ResourcesPanel.prototype = {
     {
         return WebInspector.UIString("Resources");
     },
+    
+    get mainResourceLoadTime()
+    {
+        return this._mainResourceLoadTime || -1;
+    },
+    
+    set mainResourceLoadTime(x)
+    {
+        if (this._mainResourceLoadTime === x)
+            return;
+        
+        this._mainResourceLoadTime = x;
+        
+        // Update the dividers to draw the new line
+        this._updateGraphDividersIfNeeded(true);
+    },
+    
+    get mainResourceDOMContentTime()
+    {
+        return this._mainResourceDOMContentTime || -1;
+    },
+    
+    set mainResourceDOMContentTime(x)
+    {
+        if (this._mainResourceDOMContentTime === x)
+            return;
+        
+        this._mainResourceDOMContentTime = x;
+        
+        this._updateGraphDividersIfNeeded(true);
+    },
 
     get statusBarItems()
     {
@@ -451,6 +490,9 @@ WebInspector.ResourcesPanel.prototype = {
 
         this._resources = [];
         this._staleResources = [];
+        
+        this.mainResourceLoadTime = -1;
+        this.mainResourceDOMContentTime = -1;
 
         this.resourcesTreeElement.removeChildren();
         this.viewsContainerElement.removeChildren();
@@ -702,6 +744,7 @@ WebInspector.ResourcesPanel.prototype = {
         this._currentDividerSlice = slice;
 
         this.dividersElement.removeChildren();
+        this.eventDividersElement.removeChildren();
         this.dividersLabelBarElement.removeChildren();
 
         for (var i = 1; i <= dividerCount; ++i) {
@@ -721,6 +764,43 @@ WebInspector.ResourcesPanel.prototype = {
 
             this.dividersLabelBarElement.appendChild(divider);
         }
+
+        if (this.calculator.startAtZero) {
+            // If our current sorting method starts at zero, that means it shows all
+            // resources starting at the same point, and so onLoad event and DOMContent
+            // event lines really wouldn't make much sense here, so don't render them.
+            return;
+        }
+
+        if (this.mainResourceLoadTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceLoadTime);
+
+            var loadDivider = document.createElement("div");
+            loadDivider.className = "resources-onload-divider";
+
+            var loadDividerPadding = document.createElement("div");
+            loadDividerPadding.className = "resources-event-divider-padding";
+            loadDividerPadding.style.left = percent + "%";
+            loadDividerPadding.title = WebInspector.UIString("Load event fired");
+            loadDividerPadding.appendChild(loadDivider);
+            
+            this.eventDividersElement.appendChild(loadDividerPadding);
+        }
+        
+        if (this.mainResourceDOMContentTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceDOMContentTime);
+
+            var domContentDivider = document.createElement("div");
+            domContentDivider.className = "resources-ondomcontent-divider";
+            
+            var domContentDividerPadding = document.createElement("div");
+            domContentDividerPadding.className = "resources-event-divider-padding";
+            domContentDividerPadding.style.left = percent + "%";
+            domContentDividerPadding.title = WebInspector.UIString("DOMContent event fired");
+            domContentDividerPadding.appendChild(domContentDivider);
+            
+            this.eventDividersElement.appendChild(domContentDividerPadding);
+        }
     },
 
     _updateSummaryGraph: function()
@@ -733,6 +813,7 @@ WebInspector.ResourcesPanel.prototype = {
         var scrollTop = this.containerElement.scrollTop;
         var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
         this.dividersElement.style.top = scrollTop + "px";
+        this.eventDividersElement.style.top = scrollTop + "px";
         this.dividersLabelBarElement.style.top = dividersTop + "px";
     },
 
@@ -766,6 +847,8 @@ WebInspector.ResourcesPanel.prototype = {
             return;
 
         this.resourcesTreeElement.smallChildren = !this.resourcesTreeElement.smallChildren;
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
         if (this.resourcesTreeElement.smallChildren) {
             this.resourcesGraphsElement.addStyleClass("small");
@@ -1048,6 +1131,17 @@ WebInspector.ResourceTimeCalculator.prototype = {
 
         return {start: start, middle: middle, end: end};
     },
+    
+    computePercentageFromEventTime: function(eventTime)
+    {
+        // This function computes a percentage in terms of the total loading time
+        // of a specific event. If startAtZero is set, then this is useless, and we
+        // want to return 0.
+        if (eventTime !== -1 && !this.startAtZero)
+            return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+
+        return 0;
+    },
 
     computeBarGraphLabels: function(resource)
     {
@@ -1193,13 +1287,12 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     {
         WebInspector.SidebarTreeElement.prototype.onattach.call(this);
 
-        var link = document.createElement("a");
-        link.href = this.resource.url;
-        link.className = "invisible";
-        while (this._listItemNode.firstChild)
-            link.appendChild(this._listItemNode.firstChild);
-        this._listItemNode.appendChild(link);
         this._listItemNode.addStyleClass("resources-category-" + this.resource.category.name);
+        this._listItemNode.draggable = true;
+        
+        // FIXME: should actually add handler to parent, to be resolved via
+        // https://bugs.webkit.org/show_bug.cgi?id=30227
+        this._listItemNode.addEventListener("dragstart", this.ondragstart.bind(this), false);
     },
 
     onselect: function()
@@ -1212,6 +1305,13 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
 
+    ondragstart: function(event) {
+        event.dataTransfer.setData("text/plain", this.resource.url);
+        event.dataTransfer.setData("text/uri-list", this.resource.url + "\r\n");
+        event.dataTransfer.effectAllowed = "copy";
+        return true;
+    },
+
     get mainTitle()
     {
         return this.resource.displayName;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index 3875324..fdfcd38 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -55,14 +55,16 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             var extraProperties = null;
 
             if (scopeObjectProxy.isLocal) {
-                if (scopeObjectProxy.thisObject) {
+                foundLocalScope = true;
+                title = WebInspector.UIString("Local");
+                emptyPlaceholder = WebInspector.UIString("No Variables");
+                subtitle = null;
+                if (scopeObjectProxy.thisObject)
                     extraProperties = [ new WebInspector.ObjectPropertyProxy("this", scopeObjectProxy.thisObject) ];
-                    title = WebInspector.UIString("Local");
-                } else
-                    title = WebInspector.UIString("Closure");
+            } else if (scopeObjectProxy.isClosure) {
+                title = WebInspector.UIString("Closure");
                 emptyPlaceholder = WebInspector.UIString("No Variables");
                 subtitle = null;
-                foundLocalScope = true;
             } else if (i === (scopeChain.length - 1))
                 title = WebInspector.UIString("Global");
             else if (scopeObjectProxy.isElement)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
index ae918d1..4aa0ab2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
@@ -359,7 +359,7 @@ WebInspector.ScriptsPanel.prototype = {
         return selectedCallFrame.id;
     },
 
-    evaluateInSelectedCallFrame: function(code, updateInterface, callback)
+    evaluateInSelectedCallFrame: function(code, updateInterface, objectGroup, callback)
     {
         var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
         if (!this._paused || !selectedCallFrame)
@@ -375,33 +375,17 @@ WebInspector.ScriptsPanel.prototype = {
             if (updateInterface)
                 self.sidebarPanes.scopechain.update(selectedCallFrame);
         }
-        this.doEvalInCallFrame(selectedCallFrame, code, updatingCallbackWrapper);
+        this.doEvalInCallFrame(selectedCallFrame, code, objectGroup, updatingCallbackWrapper);
     },
 
-    doEvalInCallFrame: function(callFrame, code, callback)
+    doEvalInCallFrame: function(callFrame, code, objectGroup, callback)
     {
         function evalCallback(result)
         {
             if (result)
                 callback(result.value, result.isException);
         }
-        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, evalCallback);
-    },
-
-    variablesInSelectedCallFrame: function()
-    {
-        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
-        if (!this._paused || !selectedCallFrame)
-            return {};
-
-        var result = {};
-        var scopeChain = selectedCallFrame.scopeChain;
-        for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObjectProperties = scopeChain[i].properties;
-            for (var j = 0; j < scopeObjectProperties.length; ++j)
-                result[scopeObjectProperties[j]] = true;
-        }
-        return result;
+        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
     },
 
     debuggerPaused: function(callFrames)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index e364cb2..790055a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -216,12 +217,18 @@ WebInspector.SourceFrame.prototype = {
             headElement = this.element.contentDocument.createElement("head");
             this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
         }
+        
+        var linkElement = this.element.contentDocument.createElement("link");
+        linkElement.type = "text/css";
+        linkElement.rel = "stylesheet";
+        linkElement.href = "inspectorSyntaxHighlight.css";
+        headElement.appendChild(linkElement);
 
         var styleElement = this.element.contentDocument.createElement("style");
         headElement.appendChild(styleElement);
 
         // Add these style rules here since they are specific to the Inspector. They also behave oddly and not
-        // all properties apply if added to view-source.css (becuase it is a user agent sheet.)
+        // all properties apply if added to view-source.css (because it is a user agent sheet.)
         var styleText = ".webkit-line-number { background-repeat: no-repeat; background-position: right 1px; }\n";
         styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
 
@@ -240,10 +247,6 @@ WebInspector.SourceFrame.prototype = {
         styleText += ".webkit-line-content { background-color: white; }\n";
         styleText += "@-webkit-keyframes fadeout {from {background-color: rgb(255, 255, 120);} to { background-color: white;}}\n";
         styleText += ".webkit-highlighted-line .webkit-line-content { background-color: rgb(255, 255, 120); -webkit-animation: 'fadeout' 2s 500ms}\n";
-        styleText += ".webkit-javascript-comment { color: rgb(0, 116, 0); }\n";
-        styleText += ".webkit-javascript-keyword { color: rgb(170, 13, 145); }\n";
-        styleText += ".webkit-javascript-number { color: rgb(28, 0, 207); }\n";
-        styleText += ".webkit-javascript-string, .webkit-javascript-regexp { color: rgb(196, 26, 22); }\n";
 
         // TODO: Move these styles into inspector.css once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed and popup moved into the top frame.
         styleText += ".popup-content { position: absolute; z-index: 10000; padding: 4px; background-color: rgb(203, 226, 255); -webkit-border-radius: 7px; border: 2px solid rgb(169, 172, 203); }";
@@ -253,7 +256,7 @@ WebInspector.SourceFrame.prototype = {
         styleText += ".popup-content input#bp-condition { font-family: monospace; margin: 0; border: 1px inset rgb(190, 190, 190) !important; width: 100%; box-shadow: none !important; outline: none !important; -webkit-user-modify: read-write; }";
         // This class is already in inspector.css
         styleText += ".hidden { display: none !important; }";
-        
+
         styleElement.textContent = styleText;
 
         this._needsProgramCounterImage = true;
@@ -311,11 +314,11 @@ WebInspector.SourceFrame.prototype = {
         var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
         if (!sourceRow._breakpointObject && this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
-        
+
         var breakpoint = sourceRow._breakpointObject;
         if (!breakpoint)
             return;
-        
+
         this._editBreakpointCondition(event.target, sourceRow, breakpoint);
         event.preventDefault();
     },
@@ -340,7 +343,7 @@ WebInspector.SourceFrame.prototype = {
         // TODO: Migrate the popup to the top-level document and remove the blur listener from conditionElement once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
         var popupDocument = this.element.contentDocument;
         this._showBreakpointConditionPopup(eventTarget, breakpoint.line, popupDocument);
-        
+
         function committed(element, newText)
         {
             breakpoint.condition = newText;
@@ -359,7 +362,7 @@ WebInspector.SourceFrame.prototype = {
 
         var dismissedHandler = dismissed.bind(this);
         this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
-        
+
         WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
         this._conditionEditorElement.value = breakpoint.condition;
         this._conditionEditorElement.select();
@@ -716,191 +719,394 @@ WebInspector.SourceFrame.prototype = {
         if (!table)
             return;
 
-        function deleteContinueFlags(cell)
-        {
-            if (!cell)
-                return;
-            delete cell._commentContinues;
-            delete cell._singleQuoteStringContinues;
-            delete cell._doubleQuoteStringContinues;
-            delete cell._regexpContinues;
-        }
+        var jsSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(table, this);
+        jsSyntaxHighlighter.process();
+    },
 
-        function createSpan(content, className)
-        {
-            var span = document.createElement("span");
-            span.className = className;
-            span.appendChild(document.createTextNode(content));
-            return span;
-        }
+    syntaxHighlightCSS: function()
+    {
+        var table = this.element.contentDocument.getElementsByTagName("table")[0];
+        if (!table)
+            return;
 
-        function generateFinder(regex, matchNumber, className)
-        {
-            return function(str) {
-                var match = regex.exec(str);
-                if (!match)
-                    return null;
-                previousMatchLength = match[matchNumber].length;
-                return createSpan(match[matchNumber], className);
-            };
-        }
+        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
+        cssSyntaxHighlighter.process();
+    }
+}
 
-        var findNumber = generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
-        var findKeyword = generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
-        var findSingleLineString = generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
-        var findMultilineCommentStart = generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
-        var findMultilineCommentEnd = generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
-        var findMultilineSingleQuoteStringStart = generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineSingleQuoteStringEnd = generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringStart = generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringEnd = generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
-        var findMultilineRegExpEnd = generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
-        var findSingleLineComment = generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
-
-        function findMultilineRegExpStart(str)
-        {
-            var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
-            if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
+{
+    this.table = table;
+    this.sourceFrame = sourceFrame;
+}
+
+WebInspector.SourceSyntaxHighligher.prototype = {
+    createSpan: function(content, className)
+    {
+        var span = document.createElement("span");
+        span.className = className;
+        span.appendChild(document.createTextNode(content));
+        return span;
+    },
+
+    generateFinder: function(regex, matchNumber, className)
+    {
+        return function(str) {
+            var match = regex.exec(str);
+            if (!match)
                 return null;
-            var node = createSpan(match[0], "webkit-javascript-regexp");
-            previousMatchLength = match[0].length;
-            return node;
-        }
+            this.previousMatchLength = match[matchNumber].length;
+            return this.createSpan(match[matchNumber], className);
+        };
+    },
+
+    process: function()
+    {
+        // Split up the work into chunks so we don't block the
+        // UI thread while processing.
+
+        var i = 0;
+        var rows = this.table.rows;
+        var rowsLength = rows.length;
+        var previousCell = null;
+        const linesPerChunk = 10;
 
-        function findSingleLineRegExp(str)
+        function processChunk()
         {
-            var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
-            if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
-                return null;
-            var node = createSpan(match[1], "webkit-javascript-regexp");
-            previousMatchLength = match[1].length;
-            return node;
+            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
+                var row = rows[i];
+                if (!row)
+                    continue;
+                var cell = row.cells[1];
+                if (!cell)
+                    continue;
+                this.syntaxHighlightLine(cell, previousCell);
+                if (i < (end - 1))
+                    this.deleteContinueFlags(previousCell);
+                previousCell = cell;
+            }
+
+            if (i >= rowsLength && processChunkInterval) {
+                this.deleteContinueFlags(previousCell);
+                delete this.previousMatchLength;
+                clearInterval(processChunkInterval);
+
+                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            }
         }
 
-        function syntaxHighlightJavascriptLine(line, prevLine)
-        {
-            var messageBubble = line.lastChild;
-            if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
-                line.removeChild(messageBubble);
-            else
-                messageBubble = null;
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+    }
+}
+
+WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
+    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
+    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
+    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
+    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
+    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
+    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
+}
+
+WebInspector.CSSSourceSyntaxHighligher.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._inSelector;
+    },
+
+    findPseudoClass: function(str)
+    {
+        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var span = document.createElement("span");
+        span.appendChild(document.createTextNode(match[1]));
+        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
+        return span;
+    },
+
+    findURL: function(str)
+    {
+        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
+        var outerSpan = document.createElement("span");
+        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
+        outerSpan.appendChild(document.createTextNode("("));
+        outerSpan.appendChild(innerUrlSpan);
+        outerSpan.appendChild(document.createTextNode(")"));
+        return outerSpan;
+    },
+
+    findAtRule: function(str)
+    {
+        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-css-at-rule");
+    },
 
-            var code = line.textContent;
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var code = line.textContent;
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
 
-            while (line.firstChild)
-                line.removeChild(line.firstChild);
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
 
-            var token;
-            var tmp = 0;
-            var i = 0;
-            previousMatchLength = 0;
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
+            }
+        }
 
-            if (prevLine) {
-                if (prevLine._commentContinues) {
-                    if (!(token = findMultilineCommentEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-comment");
-                        line._commentContinues = true;
+        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
+        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
+        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
+        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
+
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            var currChar = codeFragment[0];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (currChar === ";" && !inAtRuleBlock)
+                    atRuleStarted = false;
+                else if (currChar === "}") {
+                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
+                        inSelector = false;
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
+                    } else if (inSelector) {
+                        inSelector = false;
+                    } else if (inAtRuleBlock) {
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
                     }
-                } else if (prevLine._singleQuoteStringContinues) {
-                    if (!(token = findMultilineSingleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._singleQuoteStringContinues = true;
+                } else if (currChar === "{") {
+                    if (!atRuleStarted || inAtRuleBlock) {
+                        inSelector = true;
+                    } else if (!inAtRuleBlock && atRuleIsSelector) {
+                        inAtRuleBlock = true;
+                        inSelector = true;
+                    } else if (!inAtRuleBlock) {
+                        inAtRuleBlock = true;
+                        inSelector = false;
                     }
-                } else if (prevLine._doubleQuoteStringContinues) {
-                    if (!(token = findMultilineDoubleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._doubleQuoteStringContinues = true;
+                } else if (inSelector) {
+                    if (!prevChar || /^\d/.test(prevChar)) {
+                        token = this.findUnits(codeFragment);
+                    } else if (!prevChar || /^\W/.test(prevChar)) {
+                        token = this.findNumber(codeFragment) ||
+                                this.findKeyword(codeFragment) ||
+                                this.findURL(codeFragment) ||
+                                this.findProperty(codeFragment) ||
+                                this.findAtRule(codeFragment) ||
+                                this.findGenericIdent(codeFragment) ||
+                                this.findSingleLineString(codeFragment);
                     }
-                } else if (prevLine._regexpContinues) {
-                    if (!(token = findMultilineRegExpEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-regexp");
-                        line._regexpContinues = true;
+                } else if (!inSelector) {
+                    if (atRuleStarted && !inAtRuleBlock)
+                        token = this.findURL(codeFragment); // for @import
+                    if (!token) {
+                        token = this.findSelector(codeFragment) ||
+                                this.findPseudoClass(codeFragment) ||
+                                this.findAtRule(codeFragment);
                     }
                 }
-                if (token) {
-                    i += previousMatchLength ? previousMatchLength : code.length;
-                    tmp = i;
-                    line.appendChild(token);
-                }
             }
 
-            for ( ; i < code.length; ++i) {
-                var codeFragment = code.substr(i);
-                var prevChar = code[i - 1];
-                token = findSingleLineComment(codeFragment);
-                if (!token) {
-                    if ((token = findMultilineCommentStart(codeFragment)))
-                        line._commentContinues = true;
-                    else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = findNumber(codeFragment, code[i - 1]) ||
-                                findKeyword(codeFragment, code[i - 1]) ||
-                                findSingleLineString(codeFragment) ||
-                                findSingleLineRegExp(codeFragment);
-                        if (!token) {
-                            if (token = findMultilineSingleQuoteStringStart(codeFragment))
-                                line._singleQuoteStringContinues = true;
-                            else if (token = findMultilineDoubleQuoteStringStart(codeFragment))
-                                line._doubleQuoteStringContinues = true;
-                            else if (token = findMultilineRegExpStart(codeFragment))
-                                line._regexpContinues = true;
-                        }
-                    }
-                }
+            if (token) {
+                if (currChar === "@") {
+                    atRuleStarted = true;
 
-                if (token) {
-                    if (tmp !== i)
-                        line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                    line.appendChild(token);
-                    i += previousMatchLength - 1;
-                    tmp = i + 1;
+                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
+                    // instead it acts as a selector and contains properties and values.
+                    var text = token.textContent;
+                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
                 }
+
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
+        }
 
-            if (tmp < code.length)
-                line.appendChild(document.createTextNode(code.substring(tmp, i)));
+        line._inSelector = inSelector;
+        line._inAtRuleBlock = inAtRuleBlock;
+        line._atRuleStarted = atRuleStarted;
+        line._atRuleIsSelector = atRuleIsSelector;
 
-            if (messageBubble)
-                line.appendChild(messageBubble);
-        }
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
+    }
+}
 
-        var i = 0;
-        var rows = table.rows;
-        var rowsLength = rows.length;
-        var previousCell = null;
-        var previousMatchLength = 0;
-        var sourceFrame = this;
+WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+
+WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
+    this.findKeyword = this.generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
+    this.findMultilineSingleQuoteStringStart = this.generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineSingleQuoteStringEnd = this.generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringStart = this.generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringEnd = this.generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
+    this.findMultilineRegExpEnd = this.generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
+    this.findSingleLineComment = this.generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
+}
 
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._singleQuoteStringContinues;
+        delete cell._doubleQuoteStringContinues;
+        delete cell._regexpContinues;
+    },
 
-        function processChunk()
-        {
-            for (var end = Math.min(i + 10, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                syntaxHighlightJavascriptLine(cell, previousCell);
-                if (i < (end - 1))
-                    deleteContinueFlags(previousCell);
-                previousCell = cell;
+    findMultilineRegExpStart: function(str)
+    {
+        var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
+        if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-javascript-regexp");
+    },
+
+    findSingleLineRegExp: function(str)
+    {
+        var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
+        if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
+            return null;
+        this.previousMatchLength = match[1].length;
+        return this.createSpan(match[1], "webkit-javascript-regexp");
+    },
+
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var messageBubble = line.lastChild;
+        if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
+            line.removeChild(messageBubble);
+        else
+            messageBubble = null;
+
+        var code = line.textContent;
+
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
+
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
+
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            } else if (prevLine._singleQuoteStringContinues) {
+                if (!(token = this.findMultilineSingleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._singleQuoteStringContinues = true;
+                }
+            } else if (prevLine._doubleQuoteStringContinues) {
+                if (!(token = this.findMultilineDoubleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._doubleQuoteStringContinues = true;
+                }
+            } else if (prevLine._regexpContinues) {
+                if (!(token = this.findMultilineRegExpEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-regexp");
+                    line._regexpContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
             }
+        }
 
-            if (i >= rowsLength && processChunkInterval) {
-                deleteContinueFlags(previousCell);
-                clearInterval(processChunkInterval);
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (!prevChar || /^\W/.test(prevChar)) {
+                    token = this.findNumber(codeFragment) ||
+                            this.findKeyword(codeFragment) ||
+                            this.findSingleLineString(codeFragment) ||
+                            this.findSingleLineRegExp(codeFragment);
+                    if (!token) {
+                        if (token = this.findMultilineSingleQuoteStringStart(codeFragment))
+                            line._singleQuoteStringContinues = true;
+                        else if (token = this.findMultilineDoubleQuoteStringStart(codeFragment))
+                            line._doubleQuoteStringContinues = true;
+                        else if (token = this.findMultilineRegExpStart(codeFragment))
+                            line._regexpContinues = true;
+                    }
+                }
+            }
 
-                sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            if (token) {
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
         }
 
-        processChunk();
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
 
-        var processChunkInterval = setInterval(processChunk, 25);
+        if (messageBubble)
+            line.appendChild(messageBubble);
     }
 }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
-
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
index 97a5bd5..c1b1bbf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
@@ -106,11 +106,16 @@ WebInspector.SourceView.prototype = {
         this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
         
         if (this.resource.type === WebInspector.Resource.Type.Script
-            || this.resource.mimeType === 'application/json'
-            || this.resource.mimeType === 'application/javascript'
+            || this.resource.mimeType === "application/json"
+            || this.resource.mimeType === "application/javascript"
             || /\.js(on)?$/.test(this.resource.lastPathComponent) ) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
             this.sourceFrame.syntaxHighlightJavascript();
+        } else if (this.resource.type === WebInspector.Resource.Type.Stylesheet
+            || this.resource.mimeType === "text/css"
+            || /\.css$/.test(this.resource.lastPathComponent) ) {
+            this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
+            this.sourceFrame.syntaxHighlightCSS();
         } else
             this._sourceFrameSetupFinished();
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
index 01c657d..66b4a92 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
@@ -63,9 +63,6 @@ WebInspector.StoragePanel = function(database)
     this.sidebarTree.appendChild(this.cookieListTreeElement);
     this.cookieListTreeElement.expand();
 
-    this.cookieTreeElement = new WebInspector.CookieSidebarTreeElement();
-    this.cookieListTreeElement.appendChild(this.cookieTreeElement);
-
     this.storageViews = document.createElement("div");
     this.storageViews.id = "storage-views";
     this.element.appendChild(this.storageViews);
@@ -120,11 +117,14 @@ WebInspector.StoragePanel.prototype = {
 
         this._domStorage = [];
 
-        delete this._cookieView;
+        this._cookieDomains = {};
+        this._cookieViews = {};
 
         this.databasesListTreeElement.removeChildren();
         this.localStorageListTreeElement.removeChildren();
         this.sessionStorageListTreeElement.removeChildren();
+        this.cookieListTreeElement.removeChildren();
+
         this.storageViews.removeChildren();        
 
         this.storageViewStatusBarItemsContainer.removeChildren();
@@ -146,6 +146,17 @@ WebInspector.StoragePanel.prototype = {
         database._databasesTreeElement = databaseTreeElement;
         this.databasesListTreeElement.appendChild(databaseTreeElement);
     },
+    
+    addCookieDomain: function(domain)
+    {
+        // Eliminate duplicate domains from the list.
+        if (typeof this._cookieDomains[domain] !== "undefined")
+            return;
+
+        var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
+        this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
+        this._cookieDomains[domain] = true;
+    },
 
     addDOMStorage: function(domStorage)
     {
@@ -158,12 +169,12 @@ WebInspector.StoragePanel.prototype = {
             this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
-    selectDatabase: function(db)
+    selectDatabase: function(databaseId)
     {
         var database;
         for (var i = 0, len = this._databases.length; i < len; ++i) {
             database = this._databases[i];
-            if (database.isDatabase(db)) {
+            if (database.id === databaseId) {
                 this.showDatabase(database);
                 database._databasesTreeElement.select();
                 return;
@@ -240,15 +251,15 @@ WebInspector.StoragePanel.prototype = {
             this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
-    showCookies: function()
+    showCookies: function(cookieDomain)
     {
         if (this.visibleView)
             this.visibleView.hide();
 
-        var view = this._cookieView;
+        var view = this._cookieViews[cookieDomain];
         if (!view) {
-            view = new WebInspector.CookieItemsView();
-            this._cookieView = view;
+            view = new WebInspector.CookieItemsView(cookieDomain);
+            this._cookieViews[cookieDomain] = view;
         }
 
         view.show(this.storageViews);
@@ -297,20 +308,21 @@ WebInspector.StoragePanel.prototype = {
         database.getTableNames(tableNamesCallback);
     },
 
-    dataGridForResult: function(result)
+    dataGridForResult: function(rows)
     {
-        if (!result.rows.length)
+        if (!rows.length)
             return null;
 
         var columns = {};
+        var numColumns = 0;
 
-        var rows = result.rows;
-        for (var columnIdentifier in rows.item(0)) {
+        for (var columnIdentifier in rows[0]) {
             var column = {};
             column.width = columnIdentifier.length;
             column.title = columnIdentifier;
 
             columns[columnIdentifier] = column;
+            ++numColumns;
         }
 
         var nodes = [];
@@ -318,12 +330,9 @@ WebInspector.StoragePanel.prototype = {
         for (var i = 0; i < length; ++i) {
             var data = {};
 
-            var row = rows.item(i);
+            var row = rows[i];
             for (var columnIdentifier in row) {
-                // FIXME: (Bug 19439) We should specially format SQL NULL here
-                // (which is represented by JavaScript null here, and turned
-                // into the string "null" by the String() function).
-                var text = String(row[columnIdentifier]);
+                var text = row[columnIdentifier];
                 data[columnIdentifier] = text;
                 if (text.length > columns[columnIdentifier].width)
                     columns[columnIdentifier].width = text.length;
@@ -339,7 +348,7 @@ WebInspector.StoragePanel.prototype = {
             totalColumnWidths += columns[columnIdentifier].width;
 
         // Calculate the percentage width for the columns.
-        const minimumPrecent = 5;
+        const minimumPrecent = Math.min(5, Math.floor(100/numColumns));
         var recoupPercent = 0;
         for (var columnIdentifier in columns) {
             var width = columns[columnIdentifier].width;
@@ -549,7 +558,7 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 
     get mainTitle()
     {
-        return this.domStorage.domain;
+        return this.domStorage.domain ? this.domStorage.domain : WebInspector.UIString("Local Files");
     },
 
     set mainTitle(x)
@@ -570,9 +579,10 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 
 WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
 
-WebInspector.CookieSidebarTreeElement = function()
+WebInspector.CookieSidebarTreeElement = function(cookieDomain)
 {
-    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", null, "", null, false);
+    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", cookieDomain, "", null, false);
+    this._cookieDomain = cookieDomain;
 
     this.refreshTitles();
 }
@@ -580,12 +590,12 @@ WebInspector.CookieSidebarTreeElement = function()
 WebInspector.CookieSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.storage.showCookies();
+        WebInspector.panels.storage.showCookies(this._cookieDomain);
     },
-
+    
     get mainTitle()
     {
-        return WebInspector.UIString("Cookies");
+        return this._cookieDomain ? this._cookieDomain : WebInspector.UIString("Local Files");
     },
 
     set mainTitle(x)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
new file mode 100644
index 0000000..8da59e7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TestController.js
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TestController = function(callId)
+{
+    this._callId = callId;
+    this._waitUntilDone = false;
+}
+
+WebInspector.TestController.prototype = {
+    waitUntilDone: function()
+    {
+        this._waitUntilDone = true;
+    },
+
+    notifyDone: function(result)
+    {
+        var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
+        InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+    }
+}
+
+WebInspector.evaluateForTestInFrontend = function(callId, script)
+{
+    var controller = new WebInspector.TestController(callId);
+    try {
+        var result;
+        if (window[script] && typeof window[script] === "function")
+            result = window[script].call(this, controller);
+        else
+            result = window.eval(script);
+
+        if (!controller._waitUntilDone)
+            controller.notifyDone(result);
+    } catch (e) {
+        controller.notifyDone(e.toString());
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index 5ff774f..f73ab0d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -252,7 +252,7 @@ WebInspector.TextPrompt.prototype = {
                 foundNextText = true;
             }
 
-            node = node.traverseNextNode(false, this.element);
+            node = node.traverseNextNode(this.element);
         }
 
         return true;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
index 6d18732..4363da8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
@@ -45,10 +45,10 @@ WebInspector.addItemToTimeline = function(record) {
     // Not implemented.
 }
 
-WebInspector.timelineWasEnabled = function() {
+WebInspector.timelineProfilerWasStarted = function() {
     // Not implemented.
 }
 
-WebInspector.timelineWasDisabled = function() {
+WebInspector.timelineProfilerWasStopped = function() {
     // Not implemented.
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index d6d1d61..96a20ab 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -75,6 +75,8 @@ WebInspector.WatchExpressionsSection = function()
     this.editable = true;
     this.expanded = true;
     this.propertiesElement.addStyleClass("watch-expressions");
+
+    this._watchObjectGroupId = "watch-group";
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -114,6 +116,7 @@ WebInspector.WatchExpressionsSection.prototype = {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
         }
 
+        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
@@ -129,10 +132,10 @@ WebInspector.WatchExpressionsSection.prototype = {
         // which is checked in the appendResult inner function.
         for (var i = 0; i < this.watchExpressions.length; ++i) {
             var expression = this.watchExpressions[i];
-            if (!expression) 
+            if (!expression)
                 continue;
 
-            WebInspector.console.evalInInspectedWindow("(" + expression + ")", appendResult.bind(this, expression, i));
+            WebInspector.console.evalInInspectedWindow("(" + expression + ")", this._watchObjectGroupId, appendResult.bind(this, expression, i));
         }
 
         // note this is setting the expansion of the tree, not the section;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 1aaeb3d..32f15ce 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -57,6 +57,7 @@
     <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
     <file>SummaryBar.js</file>
+    <file>TestController.js</file>
     <file>TextPrompt.js</file>
     <file>TimelineAgent.js</file>
     <file>TopDownProfileDataGridTree.js</file>
@@ -65,6 +66,7 @@
     <file>View.js</file>
     <file>WatchExpressionsSidebarPane.js</file>
     <file>inspector.css</file>
+    <file>inspectorSyntaxHighlight.css</file>
     <file>Images/back.png</file>
     <file>Images/checker.png</file>
     <file>Images/clearConsoleButtonGlyph.png</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index 358c13c..fc08bc2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -211,7 +211,7 @@ body.attached #search-results-matches {
     background-image: url(Images/profilesIcon.png);
 }
 
-#close-button {
+#close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
     background-image: url(Images/closeButtons.png);
@@ -221,19 +221,27 @@ body.attached #search-results-matches {
     margin: 5px 0;
 }
 
-#close-button:hover {
+#close-button-left:hover, #close-button-right:hover {
     background-position: 14px 0;
 }
 
-#close-button:active {
+#close-button-left:active, #close-button-right:active {
     background-position: 28px 0;
 }
 
-body.detached .toolbar-item.close {
+body.detached .toolbar-item.close-left, body.detached .toolbar-item.close-right {
     display: none;
 }
 
-body.attached.platform-qt .toolbar-item.close {
+body.attached.platform-qt .toolbar-item.close-left, body.attached.platform-qt .toolbar-item.close-right {
+    display: none;
+}
+
+body.platform-mac-tiger .toolbar-item.close-right, body.platform-mac-leopard .toolbar-item.close-right { 
+    display: none;
+}
+
+body:not(.platform-mac-tiger):not(.platform-mac-leopard) .toolbar-item.close-left { 
     display: none;
 }
 
@@ -818,11 +826,6 @@ body.drawer-visible #drawer {
     vertical-align: top;
 }
 
-.invisible {
-    color: inherit;
-    text-decoration: none;
-}
-
 .webkit-line-gutter-backdrop {
     /* Keep this in sync with view-source.css (.webkit-line-gutter-backdrop) */
     width: 31px;
@@ -1637,6 +1640,10 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     background-position: -46px 0px;
 }
 
+.pane > .title > select > option, .pane > .title > select > hr {
+    color: black;
+}
+
 .pane > .body {
     position: relative;
     display: none;
@@ -2512,6 +2519,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-background-size: 1px 6px;
     -webkit-background-origin: padding;
     -webkit-background-clip: padding;
+    z-index: 400;
 }
 
 .summary-graph-legend {
@@ -2558,6 +2566,16 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     z-index: -100;
 }
 
+#resources-event-dividers {
+    position: absolute;
+    left: 0;
+    right: 0;
+    height: 100%;
+    top: 0;
+    z-index: 300;
+    pointer-events: none;
+}
+
 #resources-dividers-label-bar {
     position: absolute;
     top: 93px;
@@ -2578,6 +2596,32 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     background-color: rgba(0, 0, 0, 0.1);
 }
 
+.resources-event-divider-padding {
+    position: absolute;
+    width: 8px;
+    top: 0;
+    bottom: 0;
+    pointer-events: auto;
+}
+
+.resources-onload-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(255, 0, 0, 0.5);
+}
+
+.resources-ondomcontent-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(0, 0, 255, 0.5);
+}
+
 .resources-divider.last {
     background-color: transparent;
 }
@@ -3404,3 +3448,7 @@ ol.breakpoint-list {
 .breakpoint-list a:hover {
     color: rgb(15%, 15%, 15%);
 }
+
+.webkit-html-js-node, .webkit-html-css-node {
+    white-space: pre;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index f54e302..4fa69e0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -30,6 +30,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8">
     <link rel="stylesheet" type="text/css" href="inspector.css">
+    <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
@@ -93,13 +94,15 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScript.js"></script>
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
+    <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
-        <div class="toolbar-item close"><button id="close-button"></button></div>
+        <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
         <div class="toolbar-item flexable-space"></div>
         <div class="toolbar-item hidden" id="search-results-matches"></div>
         <div class="toolbar-item"><input id="search" type="search" incremental results="0"><div id="search-toolbar-label" class="toolbar-label"></div></div>
+        <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index de4f4fb..17b02a1 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -29,7 +29,6 @@
  */
 
 var Preferences = {
-    ignoreWhitespace: true,
     showUserAgentStyles: true,
     maxInlineTextChildLength: 80,
     minConsoleHeight: 75,
@@ -43,7 +42,8 @@ var Preferences = {
     samplingCPUProfiler: false,
     showColorNicknames: true,
     colorFormat: "hex",
-    eventListenersFilter: "all"
+    eventListenersFilter: "all",
+    resourcesLargeRows: true
 }
 
 var WebInspector = {
@@ -139,12 +139,29 @@ var WebInspector = {
             this.panels.resources = new WebInspector.ResourcesPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
             this.panels.scripts = new WebInspector.ScriptsPanel();
-        if (hiddenPanels.indexOf("profiles") === -1)
+        if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
+            this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
+        }
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
             this.panels.storage = new WebInspector.StoragePanel();      
     },
 
+    _loadPreferences: function()
+    {
+        var colorFormat = InspectorController.setting("color-format");
+        if (colorFormat)
+            Preferences.colorFormat = colorFormat;
+
+        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
+        if (eventListenersFilter)
+            Preferences.eventListenersFilter = eventListenersFilter;
+
+        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
+        if (typeof resourcesLargeRows !== "undefined")
+            Preferences.resourcesLargeRows = resourcesLargeRows;
+    },
+
     get attached()
     {
         return this._attached;
@@ -351,13 +368,7 @@ WebInspector.loaded = function()
     var platform = InspectorController.platform();
     document.body.addStyleClass("platform-" + platform);
 
-    var colorFormat = InspectorController.setting("color-format");
-    if (colorFormat)
-        Preferences.colorFormat = colorFormat;
-
-    var eventListenersFilter = InspectorController.setting("event-listeners-filter");
-    if (eventListenersFilter)
-        Preferences.eventListenersFilter = eventListenersFilter;
+    this._loadPreferences();
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -449,8 +460,9 @@ WebInspector.loaded = function()
     searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
 
-    document.getElementById("toolbar").addEventListener("mousedown", this.toolbarDragStart, true);
-    document.getElementById("close-button").addEventListener("click", this.close, true);
+    toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
+    document.getElementById("close-button-left").addEventListener("click", this.close, true);
+    document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
     InspectorController.loaded();
 }
@@ -476,7 +488,14 @@ window.addEventListener("load", windowLoaded, false);
 WebInspector.dispatch = function() {
     var methodName = arguments[0];
     var parameters = Array.prototype.slice.call(arguments, 1);
-    WebInspector[methodName].apply(this, parameters);
+
+    // We'd like to enforce asynchronous interaction between the inspector controller and the frontend.
+    // This is important to LayoutTests.
+    function delayDispatch()
+    {
+        WebInspector[methodName].apply(WebInspector, parameters);
+    }
+    setTimeout(delayDispatch, 0);
 }
 
 WebInspector.windowUnload = function(event)
@@ -537,10 +556,9 @@ WebInspector.documentClick = function(event)
 
             WebInspector.showResourceForURL(anchor.href, anchor.lineNumber, anchor.preferredPanel);
         } else {
-            var profileStringRegEx = new RegExp("webkit-profile://.+/([0-9]+)");
-            var profileString = profileStringRegEx.exec(anchor.href);
+            var profileString = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
             if (profileString)
-                WebInspector.showProfileById(profileString[1])
+                WebInspector.showProfileForURL(anchor.href);
         }
     }
 
@@ -989,6 +1007,21 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
+        
+        if (payload.loadEventTime) {
+            // This loadEventTime is for the main resource, and we want to show it
+            // for all resources on this page. This means we want to set it as a member
+            // of the resources panel instead of the individual resource.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
+        }
+        
+        if (payload.domContentEventTime) {
+            // This domContentEventTime is for the main resource, so it should go in
+            // the resources panel for the same reasons as above.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceDOMContentTime = payload.domContentEventTime;
+        }
     }
 }
 
@@ -1009,13 +1042,19 @@ WebInspector.removeResource = function(identifier)
 WebInspector.addDatabase = function(payload)
 {
     var database = new WebInspector.Database(
-        payload.database,
+        payload.id,
         payload.domain,
         payload.name,
         payload.version);
     this.panels.storage.addDatabase(database);
 }
 
+WebInspector.addCookieDomain = function(domain)
+{
+    if (this.panels.storage)
+        this.panels.storage.addCookieDomain(domain);
+}
+
 WebInspector.addDOMStorage = function(payload)
 {
     var domStorage = new WebInspector.DOMStorage(
@@ -1224,14 +1263,15 @@ WebInspector.log = function(message)
     logMessage(message);
 }
 
-WebInspector.addProfile = function(profile)
+WebInspector.addProfileHeader = function(profile)
 {
-    this.panels.profiles.addProfile(profile);
+    this.panels.profiles.addProfileHeader(WebInspector.CPUProfileType.TypeId, new WebInspector.CPUProfile(profile));
 }
 
 WebInspector.setRecordingProfile = function(isProfiling)
 {
-    this.panels.profiles.setRecordingProfile(isProfiling);
+    this.panels.profiles.getProfileType(WebInspector.CPUProfileType.TypeId).setRecordingProfile(isProfiling);
+    this.panels.profiles.updateProfileTypeButtons();
 }
 
 WebInspector.drawLoadingPieChart = function(canvas, percent) {
@@ -1337,13 +1377,9 @@ WebInspector.linkifyStringAsFragment = function(string)
         var nonLink = string.substring(0, linkIndex);
         container.appendChild(document.createTextNode(nonLink));
 
-        var profileStringRegEx = new RegExp("webkit-profile://(.+)/[0-9]+");
-        var profileStringMatches = profileStringRegEx.exec(title);
-        var profileTitle;
+        var profileStringMatches = WebInspector.ProfileType.URLRegExp.exec(title);
         if (profileStringMatches)
-            profileTitle = profileStringMatches[1];
-        if (profileTitle)
-            title = WebInspector.panels.profiles.displayTitleForProfileLink(profileTitle);
+            title = WebInspector.panels.profiles.displayTitleForProfileLink(profileStringMatches[2], profileStringMatches[1]);
 
         var realURL = (linkString.indexOf("www.") === 0 ? "http://" + linkString : linkString);
         container.appendChild(WebInspector.linkifyURLAsNode(realURL, title, null, (realURL in WebInspector.resourceURLMap)));
@@ -1356,9 +1392,9 @@ WebInspector.linkifyStringAsFragment = function(string)
     return container;
 }
 
-WebInspector.showProfileById = function(uid) {
+WebInspector.showProfileForURL = function(url) {
     WebInspector.showProfilesPanel();
-    WebInspector.panels.profiles.showProfileById(uid);
+    WebInspector.panels.profiles.showProfileForURL(url);
 }
 
 WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
new file mode 100644
index 0000000..2cbb3c5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+.webkit-css-comment { 
+    color: rgb(0, 116, 0);
+}
+
+.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
+    color: rgb(7, 144, 154);
+}
+
+.webkit-css-number {
+    color: rgb(50, 0, 255);
+}
+
+.webkit-css-property, .webkit-css-at-rule {
+    color: rgb(200, 0, 0);
+}
+
+.webkit-css-url {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-selector {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-pseudo-class {
+    color: rgb(128, 128, 128);
+}
+
+.webkit-javascript-comment {
+    color: rgb(0, 116, 0);
+}
+
+.webkit-javascript-keyword {
+    color: rgb(170, 13, 145);
+}
+
+.webkit-javascript-number {
+    color: rgb(28, 0, 207);
+}
+
+.webkit-javascript-string, .webkit-javascript-regexp {
+    color: rgb(196, 26, 22);
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index 5f41b56..6df23de 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -91,7 +91,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (startNode)
                 break;
 
-            node = node.traversePreviousNode(false, stayWithinNode);
+            node = node.traversePreviousNode(stayWithinNode);
         }
 
         if (!startNode) {
@@ -126,7 +126,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (endNode)
                 break;
 
-            node = node.traverseNextNode(false, stayWithinNode);
+            node = node.traverseNextNode(stayWithinNode);
         }
 
         if (!endNode) {
@@ -269,9 +269,6 @@ Element.prototype.offsetRelativeToWindow = function(targetWindow)
     return elementOffset;
 }
 
-Element.prototype.firstChildSkippingWhitespace = firstChildSkippingWhitespace;
-Element.prototype.lastChildSkippingWhitespace = lastChildSkippingWhitespace;
-
 Node.prototype.isWhitespace = isNodeWhitespace;
 Node.prototype.displayName = nodeDisplayName;
 Node.prototype.isAncestor = function(node)
@@ -279,8 +276,6 @@ Node.prototype.isAncestor = function(node)
     return isAncestorNode(this, node);
 };
 Node.prototype.isDescendant = isDescendantNode;
-Node.prototype.nextSiblingSkippingWhitespace = nextSiblingSkippingWhitespace;
-Node.prototype.previousSiblingSkippingWhitespace = previousSiblingSkippingWhitespace;
 Node.prototype.traverseNextNode = traverseNextNode;
 Node.prototype.traversePreviousNode = traversePreviousNode;
 Node.prototype.onlyTextChild = onlyTextChild;
@@ -455,172 +450,58 @@ function isDescendantNode(descendant)
     return isAncestorNode(descendant, this);
 }
 
-function nextSiblingSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.nextSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.nextSibling;
-    return node;
-}
-
-function previousSiblingSkippingWhitespace()
+function traverseNextNode(stayWithin)
 {
     if (!this)
         return;
-    var node = this.previousSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.previousSibling;
-    return node;
-}
 
-function firstChildSkippingWhitespace()
-{
-    if (!this)
-        return;
     var node = this.firstChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = nextSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function lastChildSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.lastChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = previousSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function traverseNextNode(skipWhitespace, stayWithin)
-{
-    if (!this)
-        return;
-
-    var node = skipWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
     if (node)
         return node;
 
     if (stayWithin && this === stayWithin)
         return null;
 
-    node = skipWhitespace ? nextSiblingSkippingWhitespace.call(this) : this.nextSibling;
+    node = this.nextSibling;
     if (node)
         return node;
 
     node = this;
-    while (node && !(skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling) && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
+    while (node && !node.nextSibling && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
         node = node.parentNode;
     if (!node)
         return null;
 
-    return skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+    return node.nextSibling;
 }
 
-function traversePreviousNode(skipWhitespace, stayWithin)
+function traversePreviousNode(stayWithin)
 {
     if (!this)
         return;
     if (stayWithin && this === stayWithin)
         return null;
-    var node = skipWhitespace ? previousSiblingSkippingWhitespace.call(this) : this.previousSibling;
-    while (node && (skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild) )
-        node = skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild;
+    var node = this.previousSibling;
+    while (node && node.lastChild)
+        node = node.lastChild;
     if (node)
         return node;
     return this.parentNode;
 }
 
-function onlyTextChild(ignoreWhitespace)
+function onlyTextChild()
 {
     if (!this)
         return null;
 
-    var firstChild = ignoreWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
+    var firstChild = this.firstChild;
     if (!firstChild || firstChild.nodeType !== Node.TEXT_NODE)
         return null;
 
-    var sibling = ignoreWhitespace ? nextSiblingSkippingWhitespace.call(firstChild) : firstChild.nextSibling;
+    var sibling = firstChild.nextSibling;
     return sibling ? null : firstChild;
 }
 
-function nodeTitleInfo(hasChildren, linkify)
-{
-    var info = {title: "", hasChildren: hasChildren};
-
-    switch (this.nodeType) {
-        case Node.DOCUMENT_NODE:
-            info.title = "Document";
-            break;
-
-        case Node.ELEMENT_NODE:
-            info.title = "<span class=\"webkit-html-tag\">&lt;" + this.nodeName.toLowerCase().escapeHTML();
-
-            if (this.hasAttributes()) {
-                for (var i = 0; i < this.attributes.length; ++i) {
-                    var attr = this.attributes[i];
-                    info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
-
-                    var value = attr.value;
-                    if (linkify && (attr.name === "src" || attr.name === "href")) {
-                        var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                        info.title += linkify(attr.value, value, "webkit-html-attribute-value", this.nodeName.toLowerCase() == "a");
-                    } else {
-                        var value = value.escapeHTML();
-                        value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
-                        info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
-                    }
-                    info.title += "\"</span>";
-                }
-            }
-            info.title += "&gt;</span>&#8203;";
-
-            // If this element only has a single child that is a text node,
-            // just show that text and the closing tag inline rather than
-            // create a subtree for them
-
-            var textChild = onlyTextChild.call(this, Preferences.ignoreWhitespace);
-            var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
-
-            if (showInlineText) {
-                info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + this.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
-                info.hasChildren = false;
-            }
-            break;
-
-        case Node.TEXT_NODE:
-            if (isNodeWhitespace.call(this))
-                info.title = "(whitespace)";
-            else
-                info.title = "\"<span class=\"webkit-html-text-node\">" + this.nodeValue.escapeHTML() + "</span>\"";
-            break
-
-        case Node.COMMENT_NODE:
-            info.title = "<span class=\"webkit-html-comment\">&lt;!--" + this.nodeValue.escapeHTML() + "--&gt;</span>";
-            break;
-
-        case Node.DOCUMENT_TYPE_NODE:
-            info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + this.nodeName;
-            if (this.publicId) {
-                info.title += " PUBLIC \"" + this.publicId + "\"";
-                if (this.systemId)
-                    info.title += " \"" + this.systemId + "\"";
-            } else if (this.systemId)
-                info.title += " SYSTEM \"" + this.systemId + "\"";
-            if (this.internalSubset)
-                info.title += " [" + this.internalSubset + "]";
-            info.title += "&gt;</span>";
-            break;
-        default:
-            info.title = this.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
-    }
-
-    return info;
-}
-
 function appropriateSelectorForNode(node, justSelector)
 {
     if (!node)
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 14edae9..391790f 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -34,6 +34,7 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include <stdio.h>
 #include <wtf/CurrentTime.h>
 
@@ -104,7 +105,7 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
     if (resource && requestIsPreload && !resource->isPreloaded())
         return 0;
     
-    if (FrameLoader::restrictAccessToLocal() && !FrameLoader::canLoad(url, String(), docLoader->doc())) {
+    if (SecurityOrigin::restrictAccessToLocal() && !SecurityOrigin::canLoad(url, String(), docLoader->doc())) {
         Document* doc = docLoader->doc();
         if (doc && !requestIsPreload)
             FrameLoader::reportLocalLoadFailed(doc->frame(), url.string());
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h b/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
index 2e0b15b..dd9bb94 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResourceClient.h
@@ -25,6 +25,8 @@
 #ifndef CachedResourceClient_h
 #define CachedResourceClient_h
 
+#include <wtf/FastAllocBase.h>
+
 #if ENABLE(XBL)
 namespace XBL {
     class XBLDocument;
@@ -48,7 +50,7 @@ namespace WebCore {
      * inherit from this class and overload one of the 3 functions
      *
      */
-    class CachedResourceClient
+    class CachedResourceClient : public FastAllocBase
     {
     public:
         virtual ~CachedResourceClient() { }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h b/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
index feb59b9..0956e0c 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResourceHandle.h
@@ -71,9 +71,10 @@ namespace WebCore {
         bool operator==(const CachedResourceHandleBase& o) const { return get() == o.get(); }
         bool operator!=(const CachedResourceHandleBase& o) const { return get() != o.get(); }
     };
-	
-    // Don't inline for winscw compiler to prevent the compiler agressively resolving 
-    // the base class of R* when CachedResourceHandler<T>(R*) is inlined.    
+
+    // Don't inline for winscw compiler to prevent the compiler agressively resolving
+    // the base class of R* when CachedResourceHandler<T>(R*) is inlined.  The bug is
+    // reported at: https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
     template <class R>
 #if !COMPILER(WINSCW)
     inline
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 14d36f1..91c7030 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -488,6 +488,7 @@ class EmptyPluginHalterClient : public PluginHalterClient
 {
 public:
     virtual bool shouldHaltPlugin(Node*) const { return false; }
+    virtual bool enabled() const { return false; }
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index 93a1f10..df46397 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -55,6 +55,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLAnchorElement.h"
 #include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
@@ -123,96 +124,12 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, formSubmission };
-
-    const Type type;
-    const double delay;
-    const String url;
-    const String referrer;
-    const FrameLoadRequest frameRequest;
-    const RefPtr<Event> event;
-    const RefPtr<FormState> formState;
-    const int historySteps;
-    const bool lockHistory;
-    const bool lockBackForwardList;
-    const bool wasUserGesture;
-    const bool wasRefresh;
-    const bool wasDuringLoad;
-    bool toldClient;
-
-    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
-        : type(redirection)
-        , delay(delay)
-        , url(url)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(false)
-        , toldClient(false)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
-        : type(locationChange)
-        , delay(0)
-        , url(url)
-        , referrer(referrer)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(duringLoad)
-        , toldClient(false)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    explicit ScheduledRedirection(int historyNavigationSteps)
-        : type(historyNavigation)
-        , delay(0)
-        , historySteps(historyNavigationSteps)
-        , lockHistory(false)
-        , lockBackForwardList(false)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(false)
-        , toldClient(false)
-    {
-    }
-
-    ScheduledRedirection(const FrameLoadRequest& frameRequest,
-            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
-            bool duringLoad)
-        : type(formSubmission)
-        , delay(0)
-        , frameRequest(frameRequest)
-        , event(event)
-        , formState(formState)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(duringLoad)
-        , toldClient(false)
-    {
-        ASSERT(!frameRequest.isEmpty());
-        ASSERT(this->formState);
-    }
-};
- 
 #if ENABLE(XHTMLMP)
 static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #else
 static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #endif
 static double storedTimeOfLastCompletedLoad;
-static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
 bool isBackForwardLoadType(FrameLoadType type)
 {
@@ -250,39 +167,36 @@ static inline bool canReferToParentFrameEncoding(const Frame* frame, const Frame
 FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
+    , m_policyChecker(frame)
+    , m_history(frame)
+    , m_notifer(frame)
     , m_state(FrameStateCommittedPage)
     , m_loadType(FrameLoadTypeStandard)
-    , m_policyLoadType(FrameLoadTypeStandard)
     , m_delegateIsHandlingProvisionalLoadError(false)
-    , m_delegateIsDecidingNavigationPolicy(false)
-    , m_delegateIsHandlingUnimplementablePolicy(false)
     , m_firstLayoutDone(false)
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
     , m_inStopAllLoaders(false)
     , m_isExecutingJavaScriptFormAction(false)
-    , m_isRunningScript(false)
     , m_didCallImplicitClose(false)
     , m_wasUnloadEventEmitted(false)
     , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
-    , m_cancellingWithLoadInProgress(false)
     , m_needsClear(false)
     , m_receivedData(false)
     , m_encodingWasChosenByUser(false)
     , m_containsPlugIns(false)
-    , m_redirectionTimer(this, &FrameLoader::redirectionTimerFired)
     , m_checkTimer(this, &FrameLoader::checkTimerFired)
     , m_shouldCallCheckCompleted(false)
     , m_shouldCallCheckLoadComplete(false)
     , m_opener(0)
-    , m_openedByDOM(false)
     , m_creatingInitialEmptyDocument(false)
     , m_isDisplayingInitialEmptyDocument(false)
     , m_committedFirstRealDocumentLoad(false)
     , m_didPerformFirstNavigation(false)
     , m_loadingFromCachedPage(false)
+    , m_suppressOpenerInNewFrame(false)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -327,7 +241,7 @@ void FrameLoader::setDefersLoading(bool defers)
         m_policyDocumentLoader->setDefersLoading(defers);
 
     if (!defers) {
-        startRedirectionTimer();
+        m_frame->redirectScheduler()->startTimer();
         startCheckCompleteTimer();
     }
 }
@@ -340,7 +254,7 @@ Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const F
         Frame* frame = frameLoaderForFrameLookup->frame()->tree()->find(request.frameName());
         if (frame && shouldAllowNavigation(frame)) {
             if (!request.resourceRequest().url().isEmpty())
-                frame->loader()->loadFrameRequest(request, false, false, 0, 0);
+                frame->loader()->loadFrameRequest(request, false, false, 0, 0, SendReferrer);
             if (Page* page = frame->page())
                 page->chrome()->focus();
             created = false;
@@ -404,15 +318,17 @@ void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool l
 
     ResourceRequest request(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy);
     
-    if (executeIfJavaScriptURL(request.url(), userGesture))
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture))
         return;
 
-    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture);
+    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture, SendReferrer);
 }
 
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy referrerPolicy)
 {
-    if (executeIfJavaScriptURL(request.url(), userGesture, false))
+    ASSERT(!m_suppressOpenerInNewFrame);
+
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture, false))
         return;
 
     String target = passedTarget;
@@ -421,11 +337,16 @@ void FrameLoader::urlSelected(const ResourceRequest& request, const String& pass
 
     FrameLoadRequest frameRequest(request, target);
 
-    if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+    if (referrerPolicy == NoReferrer) {
+        m_suppressOpenerInNewFrame = true;
+        setOpener(0);
+    } else if (frameRequest.resourceRequest().httpReferrer().isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0);
+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0, referrerPolicy);
+
+    m_suppressOpenerInNewFrame = false;
 }
 
 bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
@@ -441,7 +362,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -449,7 +370,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
         return false;
 
     if (!scriptURL.isEmpty())
-        frame->loader()->executeIfJavaScriptURL(scriptURL);
+        frame->script()->executeIfJavaScriptURL(scriptURL);
 
     return true;
 }
@@ -466,12 +387,12 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
         marginHeight = o->getMarginHeight();
     }
 
-    if (!canLoad(url, referrer)) {
+    if (!SecurityOrigin::canLoad(url, referrer, 0)) {
         FrameLoader::reportLocalLoadFailed(m_frame, url.string());
         return 0;
     }
 
-    bool hideReferrer = shouldHideReferrer(url, referrer);
+    bool hideReferrer = SecurityOrigin::shouldHideReferrer(url, referrer);
     RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
@@ -521,7 +442,7 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
 
     if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
-        executeIfJavaScriptURL(u, false, false);
+        m_frame->script()->executeIfJavaScriptURL(u, false, false);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
@@ -576,7 +497,7 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
+    targetFrame->redirectScheduler()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
 }
 
 void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolicy databasePolicy)
@@ -605,8 +526,14 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
         }
 
         // Dispatching the unload event could have made m_frame->document() null.
-        if (m_frame->document() && !m_frame->document()->inPageCache())
-            m_frame->document()->removeAllEventListeners();
+        if (m_frame->document() && !m_frame->document()->inPageCache()) {
+            // Don't remove event listeners from a transitional empty document (see bug 28716 for more information).
+            bool keepEventListeners = m_isDisplayingInitialEmptyDocument && m_provisionalDocumentLoader
+                && m_frame->document()->securityOrigin()->isSecureTransitionTo(m_provisionalDocumentLoader->url());
+
+            if (!keepEventListeners)
+                m_frame->document()->removeAllEventListeners();
+        }
     }
 
     m_isComplete = true; // to avoid calling completed() in finishedParsing()
@@ -634,7 +561,7 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         child->loader()->stopLoading(unloadEventPolicy);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 }
 
 void FrameLoader::stop()
@@ -653,7 +580,7 @@ void FrameLoader::stop()
 
 bool FrameLoader::closeURL()
 {
-    saveDocumentState();
+    history()->saveDocumentState();
     
     // Should only send the pagehide event here if the current document exists and has not been placed in the page cache.    
     Document* currentDocument = m_frame->document();
@@ -663,13 +590,6 @@ bool FrameLoader::closeURL()
     return true;
 }
 
-void FrameLoader::cancelRedirection(bool cancelWithLoadInProgress)
-{
-    m_cancellingWithLoadInProgress = cancelWithLoadInProgress;
-
-    stopRedirectionTimer();
-}
-
 KURL FrameLoader::iconURL()
 {
     // If this isn't a top level frame, return nothing
@@ -695,15 +615,14 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
+    if (m_frame->redirectScheduler()->redirectScheduledDuringLoad()) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
     }
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
     m_frame->editor()->clearLastEditCommand();
-    closeURL();
 
     m_isComplete = false;
     m_isLoadingMainResource = true;
@@ -738,71 +657,15 @@ void FrameLoader::didExplicitOpen()
     // from a subsequent window.document.open / window.document.write call. 
     // Cancelling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
-    cancelRedirection(); 
+    m_frame->redirectScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
         m_URL = m_frame->document()->url();
 }
 
-bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
-{
-    if (!protocolIsJavaScript(url))
-        return false;
-
-    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
-        return true;
-
-    const int javascriptSchemeLength = sizeof("javascript:") - 1;
-
-    String script = url.string().substring(javascriptSchemeLength);
-    ScriptValue result;
-    if (m_frame->script()->xssAuditor()->canEvaluateJavaScriptURL(script))
-        result = executeScript(decodeURLEscapeSequences(script), userGesture);
-
-    String scriptResult;
-    if (!result.getString(scriptResult))
-        return true;
-
-    SecurityOrigin* currentSecurityOrigin = m_frame->document()->securityOrigin();
-
-    // FIXME: We should always replace the document, but doing so
-    //        synchronously can cause crashes:
-    //        http://bugs.webkit.org/show_bug.cgi?id=16782
-    if (replaceDocument) {
-        stopAllLoaders();
-        begin(m_URL, true, currentSecurityOrigin);
-        write(scriptResult);
-        end();
-    }
-
-    return true;
-}
-
-ScriptValue FrameLoader::executeScript(const String& script, bool forceUserGesture)
-{
-    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_URL));
-}
-
-ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
-{
-    if (!m_frame->script()->isEnabled() || m_frame->script()->isPaused())
-        return ScriptValue();
-
-    bool wasRunningScript = m_isRunningScript;
-    m_isRunningScript = true;
-
-    ScriptValue result = m_frame->script()->evaluate(sourceCode);
-
-    if (!wasRunningScript) {
-        m_isRunningScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
 
 void FrameLoader::cancelAndClear()
 {
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     if (!m_isComplete)
         closeURL();
@@ -811,6 +674,14 @@ void FrameLoader::cancelAndClear()
     m_frame->script()->updatePlatformScriptObjects();
 }
 
+void FrameLoader::replaceDocument(const String& html)
+{
+    stopAllLoaders();
+    begin(m_URL, true, m_frame->document()->securityOrigin());
+    write(html);
+    end();
+}
+
 void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)
 {
     m_frame->editor()->clear();
@@ -853,8 +724,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
     if (clearScriptObjects)
         m_frame->script()->clearScriptObjects();
 
-    m_redirectionTimer.stop();
-    m_scheduledRedirection.clear();
+    m_frame->redirectScheduler()->clear();
 
     m_checkTimer.stop();
     m_shouldCallCheckCompleted = false;
@@ -895,7 +765,7 @@ void FrameLoader::receivedFirstData()
     else
         url = m_frame->document()->completeURL(url).string();
 
-    scheduleHTTPRedirection(delay, url);
+    m_frame->redirectScheduler()->scheduleRedirect(delay, url);
 }
 
 const String& FrameLoader::responseMIMEType() const
@@ -972,7 +842,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
             document->parseDNSPrefetchControlHeader(dnsPrefetchControl);
     }
 
-    restoreDocumentState();
+    history()->restoreDocumentState();
 
     document->implicitOpen();
     
@@ -1151,21 +1021,6 @@ void FrameLoader::startIconLoader()
     m_iconLoader->startLoading();
 }
 
-void FrameLoader::setLocalLoadPolicy(LocalLoadPolicy policy)
-{
-    localLoadPolicy = policy;
-}
-
-bool FrameLoader::restrictAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForAll;
-}
-
-bool FrameLoader::allowSubstituteDataAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForLocalOnly;
-}
-
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
@@ -1174,52 +1029,6 @@ void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
     iconDatabase()->setIconURLForPageURL(icon.string(), originalRequestURL().string());
 }
 
-void FrameLoader::restoreDocumentState()
-{
-    Document* doc = m_frame->document();
-        
-    HistoryItem* itemToRestore = 0;
-    
-    switch (loadType()) {
-        case FrameLoadTypeReload:
-        case FrameLoadTypeReloadFromOrigin:
-        case FrameLoadTypeSame:
-        case FrameLoadTypeReplace:
-            break;
-        case FrameLoadTypeBack:
-        case FrameLoadTypeBackWMLDeckNotAccessible:
-        case FrameLoadTypeForward:
-        case FrameLoadTypeIndexedBackForward:
-        case FrameLoadTypeRedirectWithLockedBackForwardList:
-        case FrameLoadTypeStandard:
-            itemToRestore = m_currentHistoryItem.get(); 
-    }
-    
-    if (!itemToRestore)
-        return;
-
-    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
-    doc->setStateForNewFormElements(itemToRestore->documentState());
-}
-
-void FrameLoader::gotoAnchor()
-{
-    // If our URL has no ref, then we have no place we need to jump to.
-    // OTOH If CSS target was set previously, we want to set it to 0, recalc
-    // and possibly repaint because :target pseudo class may have been
-    // set (see bug 11321).
-    if (!m_URL.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
-        return;
-
-    String fragmentIdentifier = m_URL.fragmentIdentifier();
-    if (gotoAnchor(fragmentIdentifier))
-        return;
-
-    // Try again after decoding the ref, based on the document's encoding.
-    if (m_decoder)
-        gotoAnchor(decodeURLEscapeSequences(fragmentIdentifier, m_decoder->encoding()));
-}
-
 void FrameLoader::finishedParsing()
 {
     if (m_creatingInitialEmptyDocument)
@@ -1242,8 +1051,7 @@ void FrameLoader::finishedParsing()
     // Check if the scrollbars are really needed for the content.
     // If not, remove them, relayout, and repaint.
     m_frame->view()->restoreScrollbar();
-
-    gotoAnchor();
+    m_frame->view()->scrollToFragment(m_URL);
 }
 
 void FrameLoader::loadDone()
@@ -1298,7 +1106,7 @@ void FrameLoader::checkCompleted()
     RefPtr<Frame> protect(m_frame);
     checkCallImplicitClose(); // if we didn't do it before
 
-    startRedirectionTimer();
+    m_frame->redirectScheduler()->startTimer();
 
     completed();
     if (m_frame->page())
@@ -1363,186 +1171,11 @@ KURL FrameLoader::completeURL(const String& url)
     return m_frame->document()->completeURL(url);
 }
 
-void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
-{
-    if (delay < 0 || delay > INT_MAX / 1000)
-        return;
-        
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    // We want a new history item if the refresh timeout is > 1 second.
-    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
-        scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
-}
-
-static bool mustLockBackForwardList(Frame* targetFrame)
-{
-    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
-    // The definition of "during load" is any time before all handlers for the load event have been run.
-    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
-    
-    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
-        Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
-            return true;
-    }
-    return false;
-}    
-
-void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
-
-    // If the URL we're going to navigate to is the same as the current one, except for the
-    // fragment part, we don't need to schedule the location change.
-    KURL parsedURL(ParsedURLString, url);
-    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_URL, parsedURL)) {
-        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
-        return;
-    }
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
-}
-
-void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
-    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
-{
-    ASSERT(m_frame->page());
-    ASSERT(!frameRequest.isEmpty());
-
-    // FIXME: Do we need special handling for form submissions where the URL is the same
-    // as the current one except for the fragment part? See scheduleLocationChange above.
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
-}
-
-void FrameLoader::scheduleRefresh(bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (m_URL.isEmpty())
-        return;
-
-    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
-}
-
-bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
-{
-    switch (redirection.type) {
-        case ScheduledRedirection::redirection:
-            return false;
-        case ScheduledRedirection::historyNavigation:
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::formSubmission:
-            return true;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-void FrameLoader::scheduleHistoryNavigation(int steps)
-{
-    if (!m_frame->page())
-        return;
-
-    scheduleRedirection(new ScheduledRedirection(steps));
-}
-
-void FrameLoader::goBackOrForward(int distance)
-{
-    if (distance == 0)
-        return;
-        
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    BackForwardList* list = page->backForwardList();
-    if (!list)
-        return;
-    
-    HistoryItem* item = list->itemAtIndex(distance);
-    if (!item) {
-        if (distance > 0) {
-            int forwardListCount = list->forwardListCount();
-            if (forwardListCount > 0) 
-                item = list->itemAtIndex(forwardListCount);
-        } else {
-            int backListCount = list->backListCount();
-            if (backListCount > 0)
-                item = list->itemAtIndex(-backListCount);
-        }
-    }
-    
-    ASSERT(item); // we should not reach this line with an empty back/forward list
-    if (item)
-        page->goToItem(item, FrameLoadTypeIndexedBackForward);
-}
-
-void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
-{
-    ASSERT(m_frame->page());
-
-    if (m_frame->page()->defersLoading())
-        return;
-
-    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
-
-    switch (redirection->type) {
-        case ScheduledRedirection::redirection:
-        case ScheduledRedirection::locationChange:
-            changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
-                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
-            return;
-        case ScheduledRedirection::historyNavigation:
-            if (redirection->historySteps == 0) {
-                // Special case for go(0) from a frame -> reload only the frame
-                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
-                return;
-            }
-            // go(i!=0) from a frame navigates into the history of the frame only,
-            // in both IE and NS (but not in Mozilla). We can't easily do that.
-            if (canGoBackOrForward(redirection->historySteps))
-                goBackOrForward(redirection->historySteps);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // The submitForm function will find a target frame before using the redirection timer.
-            // Now that the timer has fired, we need to repeat the security check which normally is done when
-            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
-            // without leaving a time window. If we fail the check just silently drop the form submission.
-            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
-                return;
-            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
-                redirection->event, redirection->formState);
-            return;
-    }
-
-    ASSERT_NOT_REACHED();
-}
-
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
 
-    HistoryItem* parentItem = currentHistoryItem();
+    HistoryItem* parentItem = history()->currentItem();
     FrameLoadType loadType = this->loadType();
     FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
@@ -1558,7 +1191,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
             // this is needed is Radar 3213556.
             workingURL = KURL(ParsedURLString, childItem->originalURLString());
             childLoadType = loadType;
-            childFrame->loader()->m_provisionalHistoryItem = childItem;
+            childFrame->loader()->history()->setProvisionalItem(childItem);
         }
     }
 
@@ -1601,54 +1234,6 @@ String FrameLoader::encoding() const
     return settings ? settings->defaultTextEncodingName() : String();
 }
 
-bool FrameLoader::gotoAnchor(const String& name)
-{
-    ASSERT(m_frame->document());
-
-    if (!m_frame->document()->haveStylesheetsLoaded()) {
-        m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(true);
-        return false;
-    }
-
-    m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(false);
-
-    Element* anchorNode = m_frame->document()->findAnchor(name);
-
-#if ENABLE(SVG)
-    if (m_frame->document()->isSVGDocument()) {
-        if (name.startsWith("xpointer(")) {
-            // We need to parse the xpointer reference here
-        } else if (name.startsWith("svgView(")) {
-            RefPtr<SVGSVGElement> svg = static_cast<SVGDocument*>(m_frame->document())->rootElement();
-            if (!svg->currentView()->parseViewSpec(name))
-                return false;
-            svg->setUseCurrentView(true);
-        } else {
-            if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
-                RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
-                if (viewElement.get()) {
-                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
-                    svg->inheritViewAttributes(viewElement.get());
-                }
-            }
-        }
-        // FIXME: need to decide which <svg> to focus on, and zoom to that one
-        // FIXME: need to actually "highlight" the viewTarget(s)
-    }
-#endif
-
-    m_frame->document()->setCSSTarget(anchorNode); // Setting to null will clear the current target.
-  
-    // Implement the rule that "" and "top" both mean top of page as in other browsers.
-    if (!anchorNode && !(name.isEmpty() || equalIgnoringCase(name, "top")))
-        return false;
-
-    if (FrameView* view = m_frame->view())
-        view->maintainScrollPositionAtAnchor(anchorNode ? static_cast<Node*>(anchorNode) : m_frame->document());
-
-    return true;
-}
-
 bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const AtomicString& frameName,
     const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
@@ -1728,11 +1313,13 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     if (renderer && !useFallback) {
         HTMLPlugInElement* element = toPlugInElement(renderer->node());
 
-        if (!canLoad(url, String(), frame()->document())) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return false;
         }
 
+        checkIfRunInsecureContent(m_frame->document()->securityOrigin(), url);
+
         widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()),
                                         element, url, paramNames, paramValues, mimeType,
                                         m_frame->document()->isPluginDocument() && !m_containsPlugIns);
@@ -1771,6 +1358,10 @@ void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const K
     if (!isMixedContent(context, url))
         return;
 
+    String message = String::format("The page at %s displayed insecure content from %s.\n",
+        m_URL.string().utf8().data(), url.string().utf8().data());
+    m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
+
     m_client->didDisplayInsecureContent();
 }
 
@@ -1779,6 +1370,10 @@ void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL&
     if (!isMixedContent(context, url))
         return;
 
+    String message = String::format("The page at %s ran insecure content from %s.\n",
+        m_URL.string().utf8().data(), url.string().utf8().data());
+    m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
+
     m_client->didRunInsecureContent(context);
 }
 
@@ -1801,16 +1396,6 @@ void FrameLoader::setOpener(Frame* opener)
     }
 }
 
-bool FrameLoader::openedByDOM() const
-{
-    return m_openedByDOM;
-}
-
-void FrameLoader::setOpenedByDOM()
-{
-    m_openedByDOM = true;
-}
-
 void FrameLoader::handleFallbackContent()
 {
     HTMLFrameOwnerElement* owner = m_frame->ownerElement();
@@ -1822,7 +1407,7 @@ void FrameLoader::handleFallbackContent()
 void FrameLoader::provisionalLoadStarted()
 {    
     m_firstLayoutDone = false;
-    cancelRedirection(true);
+    m_frame->redirectScheduler()->cancel(true);
     m_client->provisionalLoadStarted();
 }
 
@@ -1892,7 +1477,7 @@ bool FrameLoader::canCachePageContainingThisFrame()
         && !SharedWorkerRepository::hasSharedWorkers(m_frame->document())
 #endif
         && !m_frame->document()->usingGeolocation()
-        && m_currentHistoryItem
+        && history()->currentItem()
         && !m_quickRedirectComing
         && !m_documentLoader->isLoadingInAPISense()
         && !m_documentLoader->isStopping()
@@ -2043,7 +1628,7 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
 #endif
         if (m_frame->document()->usingGeolocation())
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
-        if (!m_currentHistoryItem)
+        if (!history()->currentItem())
             { PCLOG("   -No current history item"); cannotCache = true; }
         if (m_quickRedirectComing)
             { PCLOG("   -Quick redirect is coming"); cannotCache = true; }
@@ -2109,7 +1694,7 @@ private:
     
     RefPtr<Document> m_document;
 };
-    
+
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
 void FrameLoader::scrollToAnchor(const KURL& url)
@@ -2121,12 +1706,13 @@ void FrameLoader::scrollToAnchor(const KURL& url)
     }
     
     m_URL = url;
-    updateHistoryForAnchorScroll();
+    history()->updateForAnchorScroll();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
     m_frame->eventHandler()->stopAutoscrollTimer();
     started();
-    gotoAnchor();
+    if (FrameView* view = m_frame->view())
+        view->scrollToFragment(m_URL);
 
     // It's important to model this as a load that starts and immediately finishes.
     // Otherwise, the parent frame may think we never finished loading.
@@ -2139,78 +1725,11 @@ bool FrameLoader::isComplete() const
     return m_isComplete;
 }
 
-void FrameLoader::scheduleRedirection(PassOwnPtr<ScheduledRedirection> redirection)
-{
-    ASSERT(m_frame->page());
-
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (redirection->wasDuringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(UnloadEventPolicyUnloadAndPageHide);   
-    }
-
-    stopRedirectionTimer();
-    m_scheduledRedirection = redirection;
-    if (!m_isComplete && m_scheduledRedirection->type != ScheduledRedirection::redirection)
-        completed();
-    startRedirectionTimer();
-}
-
-void FrameLoader::startRedirectionTimer()
-{
-    if (!m_scheduledRedirection)
-        return;
-
-    ASSERT(m_frame->page());
-
-    if (m_redirectionTimer.isActive())
-        return;
-
-    if (m_scheduledRedirection->type == ScheduledRedirection::redirection && !allAncestorsAreComplete())
-        return;
-
-    m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
-
-    switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::redirection:
-            if (m_scheduledRedirection->toldClient)
-                return;
-            m_scheduledRedirection->toldClient = true;
-            clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
-                m_scheduledRedirection->delay,
-                currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockBackForwardList);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // FIXME: It would make sense to report form submissions as client redirects too.
-            // But we didn't do that in the past when form submission used a separate delay
-            // mechanism, so doing it will be a behavior change.
-            return;
-        case ScheduledRedirection::historyNavigation:
-            // Don't report history navigations.
-            return;
-    }
-    ASSERT_NOT_REACHED();
-}
-
-void FrameLoader::stopRedirectionTimer()
-{
-    m_redirectionTimer.stop();
-
-    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
-    if (redirection && redirection->toldClient)
-        clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
-}
-
 void FrameLoader::completed()
 {
     RefPtr<Frame> protect(m_frame);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->startRedirectionTimer();
+        child->redirectScheduler()->startTimer();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
     if (m_frame->view())
@@ -2264,7 +1783,7 @@ static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 }
 
 void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
-    PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+    PassRefPtr<Event> event, PassRefPtr<FormState> formState, ReferrerPolicy referrerPolicy)
 {    
     KURL url = request.resourceRequest().url();
 
@@ -2277,13 +1796,13 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
 
     ASSERT(frame()->document());
     if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
-        if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document()) && !SecurityOrigin::canLoad(url, referrer, 0)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
         }
     }
 
-    if (shouldHideReferrer(url, referrer))
+    if (SecurityOrigin::shouldHideReferrer(url, referrer) || referrerPolicy == NoReferrer)
         referrer = String();
     
     FrameLoadType loadType;
@@ -2340,7 +1859,8 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
     if (!targetFrame && !frameName.isEmpty()) {
-        checkNewWindowPolicy(action, request, formState.release(), frameName);
+        policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy,
+            request, formState.release(), frameName, this);
         return;
     }
 
@@ -2353,9 +1873,9 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     // work properly.
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        m_policyLoadType = newLoadType;
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
+        policyChecker()->stopCheck();
+        policyChecker()->setLoadType(newLoadType);
+        policyChecker()->checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
@@ -2404,7 +1924,7 @@ void FrameLoader::load(const ResourceRequest& request, const String& frameName,
         return;
     }
 
-    checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), request, 0, frameName);
+    policyChecker()->checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), FrameLoader::callContinueLoadAfterNewWindowPolicy, request, 0, frameName, this);
 }
 
 void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, bool lockHistory, FrameLoadType type, PassRefPtr<FormState> formState)
@@ -2462,54 +1982,41 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
     if (m_unloadEventBeingDispatched)
         return;
 
-    m_policyLoadType = type;
+    policyChecker()->setLoadType(type);
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
 
     const KURL& newURL = loader->request().url();
 
-    if (shouldScrollToAnchor(isFormSubmission, m_policyLoadType, newURL)) {
+    if (shouldScrollToAnchor(isFormSubmission, policyChecker()->loadType(), newURL)) {
         RefPtr<DocumentLoader> oldDocumentLoader = m_documentLoader;
-        NavigationAction action(newURL, m_policyLoadType, isFormSubmission);
+        NavigationAction action(newURL, policyChecker()->loadType(), isFormSubmission);
 
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
+        policyChecker()->stopCheck();
+        policyChecker()->checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         if (Frame* parent = m_frame->tree()->parent())
             loader->setOverrideEncoding(parent->loader()->documentLoader()->overrideEncoding());
 
-        stopPolicyCheck();
+        policyChecker()->stopCheck();
         setPolicyDocumentLoader(loader);
         if (loader->triggeringAction().isEmpty())
-            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
+            loader->setTriggeringAction(NavigationAction(newURL, policyChecker()->loadType(), isFormSubmission));
+
+        if (Element* ownerElement = m_frame->document()->ownerElement()) {
+            if (!ownerElement->dispatchBeforeLoadEvent(loader->request().url().string())) {
+                continueLoadAfterNavigationPolicy(loader->request(), formState, false);
+                return;
+            }
+        }
 
-        checkNavigationPolicy(loader->request(), loader, formState,
+        policyChecker()->checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
     }
 }
 
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
-{
-    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
-}
-
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
-{
-    // We can always load any URL that isn't considered local (e.g. http URLs).
-    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
-        return true;
-
-    // If we were provided a document, we let its local file policy dictate the result,
-    // otherwise we allow local loads only if the supplied referrer is also local.
-    if (securityOrigin)
-        return securityOrigin->canLoadLocalResources();
-    if (!referrer.isEmpty())
-        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
-    return false;
-}
-
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
 {
     ASSERT(!url.isEmpty());
@@ -2519,22 +2026,6 @@ void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
     frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url, 0, String());
 }
 
-bool FrameLoader::shouldHideReferrer(const KURL& url, const String& referrer)
-{
-    bool referrerIsSecureURL = protocolIs(referrer, "https");
-    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
-
-    if (!referrerIsWebURL)
-        return true;
-
-    if (!referrerIsSecureURL)
-        return false;
-
-    bool URLIsSecureURL = url.protocolIs("https");
-
-    return !URLIsSecureURL;
-}
-
 const ResourceRequest& FrameLoader::initialRequest() const
 {
     return activeDocumentLoader()->originalRequest();
@@ -2545,50 +2036,23 @@ void FrameLoader::receivedData(const char* data, int length)
     activeDocumentLoader()->receivedData(data, length);
 }
 
-void FrameLoader::handleUnimplementablePolicy(const ResourceError& error)
+bool FrameLoader::willLoadMediaElementURL(KURL& url)
 {
-    m_delegateIsHandlingUnimplementablePolicy = true;
-    m_client->dispatchUnableToImplementPolicy(error);
-    m_delegateIsHandlingUnimplementablePolicy = false;
-}
+    ResourceRequest request(url);
 
-void FrameLoader::cannotShowMIMEType(const ResourceResponse& response)
-{
-    handleUnimplementablePolicy(m_client->cannotShowMIMETypeError(response));
-}
+    unsigned long identifier;
+    ResourceError error;
+    requestFromDelegate(request, identifier, error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
 
-ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
-{
-    return m_client->interruptForPolicyChangeError(request);
-}
+    url = request.url();
 
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
-{
-    checkNavigationPolicy(newRequest, activeDocumentLoader(), 0, function, argument);
+    return error.isNull();
 }
 
-void FrameLoader::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
 {
-    ASSERT(activeDocumentLoader());
-    
-    // Always show content with valid substitute data.
-    if (activeDocumentLoader()->substituteData().isValid()) {
-        function(argument, PolicyUse);
-        return;
-    }
-
-#if ENABLE(FTPDIR)
-    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
-    Settings* settings = m_frame->settings();
-    if (settings && settings->forceFTPDirectoryListings() && MIMEType == "application/x-ftp-directory") {
-        function(argument, PolicyUse);
-        return;
-    }
-#endif
-
-    m_policyCheck.set(function, argument);
-    m_client->dispatchDecidePolicyForMIMEType(&FrameLoader::continueAfterContentPolicy,
-        MIMEType, activeDocumentLoader()->request());
+    return m_client->interruptForPolicyChangeError(request);
 }
 
 bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
@@ -2598,7 +2062,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     if (unreachableURL.isEmpty())
         return false;
 
-    if (!isBackForwardLoadType(m_policyLoadType))
+    if (!isBackForwardLoadType(policyChecker()->loadType()))
         return false;
 
     // We only treat unreachableURLs specially during the delegate callbacks
@@ -2607,7 +2071,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     // case handles malformed URLs and unknown schemes. Loading alternate content
     // at other times behaves like a standard load.
     DocumentLoader* compareDocumentLoader = 0;
-    if (m_delegateIsDecidingNavigationPolicy || m_delegateIsHandlingUnimplementablePolicy)
+    if (policyChecker()->delegateIsDecidingNavigationPolicy() || policyChecker()->delegateIsHandlingUnimplementablePolicy())
         compareDocumentLoader = m_policyDocumentLoader.get();
     else if (m_delegateIsHandlingProvisionalLoadError)
         compareDocumentLoader = m_provisionalDocumentLoader.get();
@@ -2762,7 +2226,7 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 
     m_inStopAllLoaders = true;
 
-    stopPolicyCheck();
+    policyChecker()->stopCheck();
 
     stopLoadingSubframes();
     if (m_provisionalDocumentLoader)
@@ -2893,7 +2357,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
-    cachePageForHistoryItem(m_currentHistoryItem.get());
+    cachePageForHistoryItem(history()->currentItem());
     
     if (m_loadType != FrameLoadTypeReplace)
         closeOldDataSources();
@@ -2927,7 +2391,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
 
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
-        updateHistoryForClientRedirect();
+        history()->updateForClientRedirect();
 
     if (m_loadingFromCachedPage) {
         m_frame->document()->documentDidBecomeActive();
@@ -2947,10 +2411,10 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
             // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
             // However, with today's computers and networking speeds, this won't happen in practice.
             // Could be an issue with a giant local file.
-            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
+            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), error);
         }
         
-        pageCache()->remove(m_currentHistoryItem.get());
+        pageCache()->remove(history()->currentItem());
 
         m_documentLoader->setPrimaryLoadComplete(true);
 
@@ -2968,7 +2432,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         return;
 
     m_client->setCopiesOnScroll();
-    updateHistoryForCommit();
+    history()->updateForCommit();
 
     // The call to closeURL() invokes the unload event handler, which can execute arbitrary
     // JavaScript. If the script initiates a new load, we need to abandon the current load,
@@ -3000,7 +2464,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeIndexedBackForward:
             if (Page* page = m_frame->page())
                 if (page->backForwardList()) {
-                    updateHistoryForBackForwardNavigation();
+                    history()->updateForBackForwardNavigation();
 
                     // Create a document view for this document, or used the cached view.
                     if (cachedPage) {
@@ -3018,12 +2482,12 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
         case FrameLoadTypeReplace:
-            updateHistoryForReload();
+            history()->updateForReload();
             m_client->transitionToCommittedForNewPage();
             break;
 
         case FrameLoadTypeStandard:
-            updateHistoryForStandardLoad();
+            history()->updateForStandardLoad();
 #ifndef BUILDING_ON_TIGER
             // This code was originally added for a Leopard performance imporvement. We decided to 
             // ifdef it to fix correctness issues on Tiger documented in <rdar://problem/5441823>.
@@ -3034,7 +2498,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             break;
 
         case FrameLoadTypeRedirectWithLockedBackForwardList:
-            updateHistoryForRedirectWithLockedBackForwardList();
+            history()->updateForRedirectWithLockedBackForwardList();
             m_client->transitionToCommittedForNewPage();
             break;
 
@@ -3130,7 +2594,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     // We still have to close the previous part page.
     closeURL();
@@ -3242,12 +2706,6 @@ String FrameLoader::generatedMIMETypeForURLScheme(const String& URLScheme)
     return m_client->generatedMIMETypeForURLScheme(URLScheme);
 }
 
-void FrameLoader::cancelContentPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    m_policyCheck.clear();
-}
-
 void FrameLoader::didReceiveServerRedirectForProvisionalLoadForFrame()
 {
     m_client->dispatchDidReceiveServerRedirectForProvisionalLoad();
@@ -3288,6 +2746,8 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     loader->setParsedArchiveData(mainResource->data());
 
     m_responseMIMEType = mainResource->mimeType();
+
+    closeURL();
     didOpenURL(mainResource->url());
 
     String userChosenEncoding = documentLoader()->overrideEncoding();
@@ -3367,14 +2827,6 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
     return CachePolicyVerify;
 }
 
-void FrameLoader::stopPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.cancel();
-}
-
 void FrameLoader::checkLoadCompleteForThisFrame()
 {
     ASSERT(m_client->hasWebView());
@@ -3397,7 +2849,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             RefPtr<HistoryItem> item;
             if (Page* page = m_frame->page())
                 if (isBackForwardLoadType(loadType()) && m_frame == page->mainFrame())
-                    item = m_currentHistoryItem;
+                    item = history()->currentItem();
                 
             bool shouldReset = true;
             if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
@@ -3446,7 +2898,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             // If the user had a scroll point, scroll to it, overriding the anchor point if any.
             if (Page* page = m_frame->page())
                 if ((isBackForwardLoadType(m_loadType) || m_loadType == FrameLoadTypeReload || m_loadType == FrameLoadTypeReloadFromOrigin) && page->backForwardList())
-                    restoreScrollPositionAndViewState();
+                    history()->restoreScrollPositionAndViewState();
 
             if (m_creatingInitialEmptyDocument || !m_committedFirstRealDocumentLoad)
                 return;
@@ -3473,14 +2925,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
     ASSERT_NOT_REACHED();
 }
 
-void FrameLoader::continueAfterContentPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.call(policy);
-}
-
-void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
+void FrameLoader::continueLoadAfterWillSubmitForm()
 {
     if (!m_provisionalDocumentLoader)
         return;
@@ -3503,7 +2948,7 @@ void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
 
     if (Page* page = m_frame->page()) {
         identifier = page->progress()->createUniqueIdentifier();
-        dispatchAssignIdentifierToInitialRequest(identifier, m_provisionalDocumentLoader.get(), m_provisionalDocumentLoader->originalRequest());
+        notifier()->assignIdentifierToInitialRequest(identifier, m_provisionalDocumentLoader.get(), m_provisionalDocumentLoader->originalRequest());
     }
 
     if (!m_provisionalDocumentLoader->startLoadingMainResource(identifier))
@@ -3514,7 +2959,7 @@ void FrameLoader::didFirstLayout()
 {
     if (Page* page = m_frame->page())
         if (isBackForwardLoadType(m_loadType) && page->backForwardList())
-            restoreScrollPositionAndViewState();
+            history()->restoreScrollPositionAndViewState();
 
     m_firstLayoutDone = true;
     m_client->dispatchDidFirstLayout();
@@ -3531,9 +2976,7 @@ void FrameLoader::frameLoadCompleted()
 
     m_client->frameLoadCompleted();
 
-    // Even if already complete, we might have set a previous item on a frame that
-    // didn't do any data loading on the past transaction. Make sure to clear these out.
-    m_previousHistoryItem = 0;
+    history()->updateForFrameLoadCompleted();
 
     // After a canceled provisional load, firstLayoutDone is false.
     // Reset it to true if we're displaying a page.
@@ -3634,7 +3077,7 @@ void FrameLoader::detachFromParent()
 
     closeURL();
     stopAllLoaders();
-    saveScrollPositionAndViewStateToItem(currentHistoryItem());
+    history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
     detachChildren();
 
 #if ENABLE(INSPECTOR)
@@ -3777,7 +3220,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
         if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
             targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
-            checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
+            policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy, workingResourceRequest, formState.release(), frameName, this);
     } else
         loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
@@ -3785,7 +3228,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
 unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
     String referrer = m_outgoingReferrer;
-    if (shouldHideReferrer(request.url(), referrer))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), referrer))
         referrer = String();
     
     ResourceRequest initialRequest = request;
@@ -3820,49 +3263,9 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         }
 #endif
     }
-    
-    sendRemainingDelegateMessages(identifier, response, data.size(), error);
-    return identifier;
-}
-
-void FrameLoader::assignIdentifierToInitialRequest(unsigned long identifier, const ResourceRequest& clientRequest)
-{
-    return dispatchAssignIdentifierToInitialRequest(identifier, activeDocumentLoader(), clientRequest);
-}
-
-void FrameLoader::willSendRequest(ResourceLoader* loader, ResourceRequest& clientRequest, const ResourceResponse& redirectResponse)
-{
-    applyUserAgent(clientRequest);
-    dispatchWillSendRequest(loader->documentLoader(), loader->identifier(), clientRequest, redirectResponse);
-}
-
-void FrameLoader::didReceiveResponse(ResourceLoader* loader, const ResourceResponse& r)
-{
-    activeDocumentLoader()->addResponse(r);
-    
-    if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), r);
-    dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
-}
 
-void FrameLoader::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
-{
-    if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), data, length);
-    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
-}
-
-void FrameLoader::didFailToLoad(ResourceLoader* loader, const ResourceError& error)
-{
-    if (Page* page = m_frame->page())
-        page->progress()->completeProgress(loader->identifier());
-    if (!error.isNull())
-        m_client->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
-}
-
-void FrameLoader::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
-{
-    m_client->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), error);
+    return identifier;
 }
 
 const ResourceRequest& FrameLoader::originalRequest() const
@@ -3876,7 +3279,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
     RefPtr<Frame> protect(m_frame);
 
     RefPtr<DocumentLoader> loader = activeDocumentLoader();
-    
+
     if (isComplete) {
         // FIXME: Don't want to do this if an entirely new load is going, so should check
         // that both data sources on the frame are either this or nil.
@@ -3884,7 +3287,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         if (m_client->shouldFallBack(error))
             handleFallbackContent();
     }
-    
+
     if (m_state == FrameStateProvisional && m_provisionalDocumentLoader) {
         if (m_submittedFormURL == m_provisionalDocumentLoader->originalRequestCopy().url())
             m_submittedFormURL = KURL();
@@ -3892,7 +3295,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         // We might have made a page cache item, but now we're bailing out due to an error before we ever
         // transitioned to the new page (before WebFrameState == commit).  The goal here is to restore any state
         // so that the existing view (that wenever got far enough to replace) can continue being used.
-        invalidateCurrentItemCachedPage();
+        history()->invalidateCurrentItemCachedPage();
         
         // Call clientRedirectCancelledOrFinished here so that the frame load delegate is notified that the redirect's
         // status has changed, if there was a redirect. The frame load delegate may have saved some state about
@@ -3902,8 +3305,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         if (m_sentRedirectNotification)
             clientRedirectCancelledOrFinished(false);
     }
-    
-    
+
     loader->mainReceivedError(error, isComplete);
 }
 
@@ -3916,7 +3318,7 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedBackForwardList;
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
@@ -3937,7 +3339,7 @@ void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequ
         // we have already saved away the scroll and doc state for the long slow load,
         // but it's not an obvious case.
 
-        addHistoryItemForFragmentScroll();
+        history()->updateBackForwardListForFragmentScroll();
     }
     
     scrollToAnchor(url);
@@ -3972,101 +3374,6 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType load
         && !m_frame->document()->isFrameSet();
 }
 
-void FrameLoader::checkNewWindowPolicy(const NavigationAction& action, const ResourceRequest& request,
-    PassRefPtr<FormState> formState, const String& frameName)
-{
-    m_policyCheck.set(request, formState, frameName,
-        callContinueLoadAfterNewWindowPolicy, this);
-    m_client->dispatchDecidePolicyForNewWindowAction(&FrameLoader::continueAfterNewWindowPolicy,
-        action, request, formState, frameName);
-}
-
-void FrameLoader::continueAfterNewWindowPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse:
-            break;
-    }
-
-    check.call(policy == PolicyUse);
-}
-
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
-    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
-{
-    NavigationAction action = loader->triggeringAction();
-    if (action.isEmpty()) {
-        action = NavigationAction(request.url(), NavigationTypeOther);
-        loader->setTriggeringAction(action);
-    }
-        
-    // Don't ask more than once for the same request or if we are loading an empty URL.
-    // This avoids confusion on the part of the client.
-    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
-        function(argument, request, 0, true);
-        loader->setLastCheckedRequest(request);
-        return;
-    }
-    
-    // We are always willing to show alternate content for unreachable URLs;
-    // treat it like a reload so it maintains the right state for b/f list.
-    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
-        if (isBackForwardLoadType(m_policyLoadType))
-            m_policyLoadType = FrameLoadTypeReload;
-        function(argument, request, 0, true);
-        return;
-    }
-    
-    loader->setLastCheckedRequest(request);
-
-    m_policyCheck.set(request, formState.get(), function, argument);
-
-    m_delegateIsDecidingNavigationPolicy = true;
-    m_client->dispatchDecidePolicyForNavigationAction(&FrameLoader::continueAfterNavigationPolicy,
-        action, request, formState);
-    m_delegateIsDecidingNavigationPolicy = false;
-}
-
-void FrameLoader::continueAfterNavigationPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    bool shouldContinue = policy == PolicyUse;
-    
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse: {
-            ResourceRequest request(check.request());
-            
-            if (!m_client->canHandleRequest(request)) {
-                handleUnimplementablePolicy(m_client->cannotShowURLError(check.request()));
-                check.clearRequest();
-                shouldContinue = false;
-            }
-            break;
-        }
-    }
-
-    check.call(shouldContinue);
-}
-
 void FrameLoader::callContinueLoadAfterNavigationPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, bool shouldContinue)
 {
@@ -4081,7 +3388,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     // through this method already, nested; otherwise, policyDataSource should still be set.
     ASSERT(m_policyDocumentLoader || !m_provisionalDocumentLoader->unreachableURL().isEmpty());
 
-    bool isTargetItem = m_provisionalHistoryItem ? m_provisionalHistoryItem->isTargetItem() : false;
+    bool isTargetItem = history()->provisionalItem() ? history()->provisionalItem()->isTargetItem() : false;
 
     // Two reasons we can't continue:
     //    1) Navigation policy delegate said we can't so request is nil. A primary case of this 
@@ -4101,10 +3408,10 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         // If the navigation request came from the back/forward menu, and we punt on it, we have the 
         // problem that we have optimistically moved the b/f cursor already, so move it back.  For sanity, 
         // we only do this when punting a navigation for the target frame or top-level frame.  
-        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(m_policyLoadType))
+        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(policyChecker()->loadType()))
             if (Page* page = m_frame->page()) {
                 Frame* mainFrame = page->mainFrame();
-                if (HistoryItem* resetItem = mainFrame->loader()->m_currentHistoryItem.get()) {
+                if (HistoryItem* resetItem = mainFrame->loader()->history()->currentItem()) {
                     page->backForwardList()->goToItem(resetItem);
                     Settings* settings = m_frame->settings();
                     page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : resetItem);
@@ -4113,7 +3420,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
     }
 
-    FrameLoadType type = m_policyLoadType;
+    FrameLoadType type = policyChecker()->loadType();
     stopAllLoaders();
     
     // <rdar://problem/6250856> - In certain circumstances on pages with multiple frames, stopAllLoaders()
@@ -4138,12 +3445,11 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
 
     if (formState)
-        m_client->dispatchWillSubmitForm(&FrameLoader::continueLoadAfterWillSubmitForm, formState);
+        m_client->dispatchWillSubmitForm(&PolicyChecker::continueLoadAfterWillSubmitForm, formState);
     else
         continueLoadAfterWillSubmitForm();
 }
 
-
 void FrameLoader::callContinueLoadAfterNewWindowPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, bool shouldContinue)
 {
@@ -4165,26 +3471,13 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     if (frameName != "_blank")
         mainFrame->tree()->setName(frameName);
 
-    mainFrame->loader()->setOpenedByDOM();
+    mainFrame->page()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
-    mainFrame->loader()->setOpener(frame.get());
+    if (!m_suppressOpenerInNewFrame)
+        mainFrame->loader()->setOpener(frame.get());
     mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
 }
 
-void FrameLoader::sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
-{    
-    if (!response.isNull())
-        dispatchDidReceiveResponse(m_documentLoader.get(), identifier, response);
-    
-    if (length > 0)
-        dispatchDidReceiveContentLength(m_documentLoader.get(), identifier, length);
-    
-    if (error.isNull())
-        dispatchDidFinishLoading(m_documentLoader.get(), identifier);
-    else
-        m_client->dispatchDidFailLoading(m_documentLoader.get(), identifier, error);
-}
-
 void FrameLoader::requestFromDelegate(ResourceRequest& request, unsigned long& identifier, ResourceError& error)
 {
     ASSERT(!request.isNull());
@@ -4192,11 +3485,11 @@ void FrameLoader::requestFromDelegate(ResourceRequest& request, unsigned long& i
     identifier = 0;
     if (Page* page = m_frame->page()) {
         identifier = page->progress()->createUniqueIdentifier();
-        dispatchAssignIdentifierToInitialRequest(identifier, m_documentLoader.get(), request);
+        notifier()->assignIdentifierToInitialRequest(identifier, m_documentLoader.get(), request);
     }
 
     ResourceRequest newRequest(request);
-    dispatchWillSendRequest(m_documentLoader.get(), identifier, newRequest, ResourceResponse());
+    notifier()->dispatchWillSendRequest(m_documentLoader.get(), identifier, newRequest, ResourceResponse());
 
     if (newRequest.isNull())
         error = cancelledError(request);
@@ -4234,7 +3527,7 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     unsigned long identifier;
     ResourceError error;
     requestFromDelegate(request, identifier, error);
-    sendRemainingDelegateMessages(identifier, resource->response(), resource->encodedSize(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), error);
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
@@ -4262,34 +3555,9 @@ bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, con
     return false;
 }
 
-bool FrameLoader::canGoBackOrForward(int distance) const
-{
-    if (Page* page = m_frame->page()) {
-        if (distance == 0)
-            return true;
-        if (distance > 0 && distance <= page->backForwardList()->forwardListCount())
-            return true;
-        if (distance < 0 && -distance <= page->backForwardList()->backListCount())
-            return true;
-    }
-    return false;
-}
-
-int FrameLoader::getHistoryLength()
-{
-    if (Page* page = m_frame->page())
-        return page->backForwardList()->backListCount() + 1;
-    return 0;
-}
-
-void FrameLoader::addHistoryItemForFragmentScroll()
-{
-    addBackForwardItemClippedAtTarget(false);
-}
-
 bool FrameLoader::loadProvisionalItemFromCachedPage()
 {
-    RefPtr<CachedPage> cachedPage = pageCache()->get(m_provisionalHistoryItem.get());
+    RefPtr<CachedPage> cachedPage = pageCache()->get(history()->provisionalItem());
     if (!cachedPage || !cachedPage->document())
         return false;
 
@@ -4333,119 +3601,21 @@ void FrameLoader::pageHidden()
 
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const
 {
-    if (!m_currentHistoryItem)
+    if (!history()->currentItem())
         return false;
-    return url == m_currentHistoryItem->url() || url == m_currentHistoryItem->originalURL();
-}
-
-PassRefPtr<HistoryItem> FrameLoader::createHistoryItem(bool useOriginal)
-{
-    DocumentLoader* docLoader = documentLoader();
-    
-    KURL unreachableURL = docLoader ? docLoader->unreachableURL() : KURL();
-    
-    KURL url;
-    KURL originalURL;
-
-    if (!unreachableURL.isEmpty()) {
-        url = unreachableURL;
-        originalURL = unreachableURL;
-    } else {
-        originalURL = docLoader ? docLoader->originalURL() : KURL();
-        if (useOriginal)
-            url = originalURL;
-        else if (docLoader)
-            url = docLoader->requestURL();
-    }
-
-    LOG(History, "WebCoreHistory: Creating item for %s", url.string().ascii().data());
-    
-    // Frames that have never successfully loaded any content
-    // may have no URL at all. Currently our history code can't
-    // deal with such things, so we nip that in the bud here.
-    // Later we may want to learn to live with nil for URL.
-    // See bug 3368236 and related bugs for more information.
-    if (url.isEmpty()) 
-        url = blankURL();
-    if (originalURL.isEmpty())
-        originalURL = blankURL();
-    
-    Frame* parentFrame = m_frame->tree()->parent();
-    String parent = parentFrame ? parentFrame->tree()->name() : "";
-    String title = docLoader ? docLoader->title() : "";
-
-    RefPtr<HistoryItem> item = HistoryItem::create(url, m_frame->tree()->name(), parent, title);
-    item->setOriginalURLString(originalURL.string());
-
-    if (!unreachableURL.isEmpty() || !docLoader || docLoader->response().httpStatusCode() >= 400)
-        item->setLastVisitWasFailure(true);
-
-    // Save form state if this is a POST
-    if (docLoader) {
-        if (useOriginal)
-            item->setFormInfoFromRequest(docLoader->originalRequest());
-        else
-            item->setFormInfoFromRequest(docLoader->request());
-    }
-    
-    // Set the item for which we will save document state
-    m_previousHistoryItem = m_currentHistoryItem;
-    m_currentHistoryItem = item;
-    
-    return item.release();
+    return url == history()->currentItem()->url() || url == history()->currentItem()->originalURL();
 }
 
-void FrameLoader::addBackForwardItemClippedAtTarget(bool doClip)
+void FrameLoader::checkDidPerformFirstNavigation()
 {
-    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
-    // The item that was the target of the user's navigation is designated as the "targetItem".  
-    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
-    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
-
     Page* page = m_frame->page();
     if (!page)
         return;
 
-    if (documentLoader()->urlForHistory().isEmpty())
-        return;
-
-    Frame* mainFrame = page->mainFrame();
-    ASSERT(mainFrame);
-    FrameLoader* frameLoader = mainFrame->loader();
-
-    if (!frameLoader->m_didPerformFirstNavigation && page->backForwardList()->entries().size() == 1) {
-        frameLoader->m_didPerformFirstNavigation = true;
+    if (!m_didPerformFirstNavigation && page->backForwardList()->entries().size() == 1) {
+        m_didPerformFirstNavigation = true;
         m_client->didPerformFirstNavigation();
     }
-
-    RefPtr<HistoryItem> item = frameLoader->createHistoryItemTree(m_frame, doClip);
-    LOG(BackForward, "WebCoreBackForward - Adding backforward item %p for frame %s", item.get(), documentLoader()->url().string().ascii().data());
-    page->backForwardList()->addItem(item);
-}
-
-PassRefPtr<HistoryItem> FrameLoader::createHistoryItemTree(Frame* targetFrame, bool clipAtTarget)
-{
-    RefPtr<HistoryItem> bfItem = createHistoryItem(m_frame->tree()->parent() ? true : false);
-    if (m_previousHistoryItem)
-        saveScrollPositionAndViewStateToItem(m_previousHistoryItem.get());
-    if (!(clipAtTarget && m_frame == targetFrame)) {
-        // save frame state for items that aren't loading (khtml doesn't save those)
-        saveDocumentState();
-        for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
-            FrameLoader* childLoader = child->loader();
-            bool hasChildLoaded = childLoader->frameHasLoaded();
-            
-            // If the child is a frame corresponding to an <object> element that never loaded,
-            // we don't want to create a history item, because that causes fallback content
-            // to be ignored on reload.
-            
-            if (!(!hasChildLoaded && childLoader->isHostedByObjectElement()))
-                bfItem->addChildItem(childLoader->createHistoryItemTree(targetFrame, clipAtTarget));
-        }
-    }
-    if (m_frame == targetFrame)
-        bfItem->setIsTargetItem(true);
-    return bfItem;
 }
 
 Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
@@ -4456,100 +3626,10 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
     return frame;
 }
 
-void FrameLoader::saveScrollPositionAndViewStateToItem(HistoryItem* item)
-{
-    if (!item || !m_frame->view())
-        return;
-        
-    item->setScrollPoint(m_frame->view()->scrollPosition());
-    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
-    m_client->saveViewStateToItem(item);
-}
-
-/*
- There is a race condition between the layout and load completion that affects restoring the scroll position.
- We try to restore the scroll position at both the first layout and upon load completion.
- 
- 1) If first layout happens before the load completes, we want to restore the scroll position then so that the
- first time we draw the page is already scrolled to the right place, instead of starting at the top and later
- jumping down.  It is possible that the old scroll position is past the part of the doc laid out so far, in
- which case the restore silent fails and we will fix it in when we try to restore on doc completion.
- 2) If the layout happens after the load completes, the attempt to restore at load completion time silently
- fails.  We then successfully restore it when the layout happens.
-*/
-void FrameLoader::restoreScrollPositionAndViewState()
-{
-    if (!m_committedFirstRealDocumentLoad)
-        return;
-
-    ASSERT(m_currentHistoryItem);
-    
-    // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
-    // One counterexample is <rdar://problem/4917290>
-    // For now, to cover this issue in release builds, there is no technical harm to returning
-    // early and from a user standpoint - as in the above radar - the previous page load failed 
-    // so there *is* no scroll or view state to restore!
-    if (!m_currentHistoryItem)
-        return;
-    
-    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling
-    // through to the client. It's currently used only for the PDF view on Mac.
-    m_client->restoreViewState();
-    
-    if (FrameView* view = m_frame->view())
-        if (!view->wasScrolledByUser())
-            view->setScrollPosition(m_currentHistoryItem->scrollPoint());
-}
-
-void FrameLoader::invalidateCurrentItemCachedPage()
-{
-    // When we are pre-commit, the currentItem is where the pageCache data resides    
-    CachedPage* cachedPage = pageCache()->get(m_currentHistoryItem.get());
-
-    // FIXME: This is a grotesque hack to fix <rdar://problem/4059059> Crash in RenderFlow::detach
-    // Somehow the PageState object is not properly updated, and is holding onto a stale document.
-    // Both Xcode and FileMaker see this crash, Safari does not.
-    
-    ASSERT(!cachedPage || cachedPage->document() == m_frame->document());
-    if (cachedPage && cachedPage->document() == m_frame->document()) {
-        cachedPage->document()->setInPageCache(false);
-        cachedPage->clear();
-    }
-    
-    if (cachedPage)
-        pageCache()->remove(m_currentHistoryItem.get());
-}
-
-void FrameLoader::saveDocumentState()
-{
-    if (m_creatingInitialEmptyDocument)
-        return;
-
-    // For a standard page load, we will have a previous item set, which will be used to
-    // store the form state.  However, in some cases we will have no previous item, and
-    // the current item is the right place to save the state.  One example is when we
-    // detach a bunch of frames because we are navigating from a site with frames to
-    // another site.  Another is when saving the frame state of a frame that is not the
-    // target of the current navigation (if we even decide to save with that granularity).
-
-    // Because of previousItem's "masking" of currentItem for this purpose, it's important
-    // that previousItem be cleared at the end of a page transition.  We leverage the
-    // checkLoadComplete recursion to achieve this goal.
-
-    HistoryItem* item = m_previousHistoryItem ? m_previousHistoryItem.get() : m_currentHistoryItem.get();
-    if (!item)
-        return;
-
-    Document* document = m_frame->document();
-    ASSERT(document);
-    
-    if (item->isCurrentDocument(document)) {
-        LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
-        item->setDocumentState(document->formElementsState());
-    }
-}
-
 // Loads content into this frame, as specified by history item
+// FIXME: This function should really be split into a couple pieces, some of
+// which should be methods of HistoryController and some of which should be
+// methods of FrameLoader.
 void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 {
     if (!m_frame->page())
@@ -4568,7 +3648,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     // check for all that as an additional optimization.
     // We also do not do anchor-style navigation if we're posting a form or navigating from
     // a page that was resulted from a form post.
-    bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
+    bool shouldScroll = !formData && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item);
 
 #if ENABLE(WML)
     // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
@@ -4578,12 +3658,12 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 
     if (shouldScroll) {
         // Must do this maintenance here, since we don't go through a real page reload
-        saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
+        history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
 
         if (FrameView* view = m_frame->view())
             view->setWasScrolledByUser(false);
 
-        m_currentHistoryItem = item;
+        history()->setCurrentItem(item);
 
         // FIXME: Form state might need to be saved here too.
 
@@ -4592,7 +3672,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         scrollToAnchor(item->url());
     
         // must do this maintenance here, since we don't go through a real page reload
-        restoreScrollPositionAndViewState();
+        history()->restoreScrollPositionAndViewState();
         
         // Fake the URL change by updating the data source's request.  This will no longer
         // be necessary if we do the better fix described above.
@@ -4604,7 +3684,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         m_client->didFinishLoad();
     } else {
         // Remember this item so we can traverse any child items as child frames load
-        m_provisionalHistoryItem = item;
+        history()->setProvisionalItem(item);
 
         bool inPageCache = false;
         
@@ -4621,7 +3701,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
                 inPageCache = true;
             } else {
-                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", m_provisionalHistoryItem->url().string().ascii().data());
+                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
                 pageCache()->remove(item);
             }
         }
@@ -4696,322 +3776,6 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     }
 }
 
-// Walk the frame tree and ensure that the URLs match the URLs in the item.
-bool FrameLoader::urlsMatchItem(HistoryItem* item) const
-{
-    const KURL& currentURL = documentLoader()->url();
-    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
-        return false;
-
-    const HistoryItemVector& childItems = item->children();
-
-    unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i) {
-        Frame* childFrame = m_frame->tree()->child(childItems[i]->target());
-        if (childFrame && !childFrame->loader()->urlsMatchItem(childItems[i].get()))
-            return false;
-    }
-
-    return true;
-}
-
-// Main funnel for navigating to a previous location (back/forward, non-search snap-back)
-// This includes recursion to handle loading into framesets properly
-void FrameLoader::goToItem(HistoryItem* targetItem, FrameLoadType type)
-{
-    ASSERT(!m_frame->tree()->parent());
-    
-    // shouldGoToHistoryItem is a private delegate method. This is needed to fix:
-    // <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
-    // Ultimately, history item navigations should go through the policy delegate. That's covered in:
-    // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    if (!m_client->shouldGoToHistoryItem(targetItem))
-        return;
-
-    // Set the BF cursor before commit, which lets the user quickly click back/forward again.
-    // - plus, it only makes sense for the top level of the operation through the frametree,
-    // as opposed to happening for some/one of the page commits that might happen soon
-    BackForwardList* bfList = page->backForwardList();
-    HistoryItem* currentItem = bfList->currentItem();    
-    bfList->goToItem(targetItem);
-    Settings* settings = m_frame->settings();
-    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
-    recursiveGoToItem(targetItem, currentItem, type);
-}
-
-// The general idea here is to traverse the frame tree and the item tree in parallel,
-// tracking whether each frame already has the content the item requests.  If there is
-// a match (by URL), we just restore scroll position and recurse.  Otherwise we must
-// reload that frame, and all its kids.
-void FrameLoader::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, FrameLoadType type)
-{
-    ASSERT(item);
-    ASSERT(fromItem);
-    
-    KURL itemURL = item->url();
-    KURL currentURL;
-    if (documentLoader())
-        currentURL = documentLoader()->url();
-    
-    // Always reload the target frame of the item we're going to.  This ensures that we will
-    // do -some- load for the transition, which means a proper notification will be posted
-    // to the app.
-    // The exact URL has to match, including fragment.  We want to go through the _load
-    // method, even if to do a within-page navigation.
-    // The current frame tree and the frame tree snapshot in the item have to match.
-    if (!item->isTargetItem() &&
-        itemURL == currentURL &&
-        ((m_frame->tree()->name().isEmpty() && item->target().isEmpty()) || m_frame->tree()->name() == item->target()) &&
-        childFramesMatchItem(item))
-    {
-        // This content is good, so leave it alone and look for children that need reloading
-        // Save form state (works from currentItem, since prevItem is nil)
-        ASSERT(!m_previousHistoryItem);
-        saveDocumentState();
-        saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
-
-        if (FrameView* view = m_frame->view())
-            view->setWasScrolledByUser(false);
-
-        m_currentHistoryItem = item;
-                
-        // Restore form state (works from currentItem)
-        restoreDocumentState();
-        
-        // Restore the scroll position (we choose to do this rather than going back to the anchor point)
-        restoreScrollPositionAndViewState();
-        
-        const HistoryItemVector& childItems = item->children();
-        
-        int size = childItems.size();
-        for (int i = 0; i < size; ++i) {
-            String childFrameName = childItems[i]->target();
-            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
-            ASSERT(fromChildItem || fromItem->isTargetItem());
-            Frame* childFrame = m_frame->tree()->child(childFrameName);
-            ASSERT(childFrame);
-            childFrame->loader()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
-        }
-    } else {
-        loadItem(item, type);
-    }
-}
-
-// helper method that determines whether the subframes described by the item's subitems
-// match our own current frameset
-bool FrameLoader::childFramesMatchItem(HistoryItem* item) const
-{
-    const HistoryItemVector& childItems = item->children();
-    if (childItems.size() != m_frame->tree()->childCount())
-        return false;
-    
-    unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i) {
-        if (!m_frame->tree()->child(childItems[i]->target()))
-            return false;
-    }
-    
-    // Found matches for all item targets
-    return true;
-}
-
-// There are 3 things you might think of as "history", all of which are handled by these functions.
-//
-//     1) Back/forward: The m_currentHistoryItem is part of this mechanism.
-//     2) Global history: Handled by the client.
-//     3) Visited links: Handled by the PageGroup.
-
-void FrameLoader::updateHistoryForStandardLoad()
-{
-    LOG(History, "WebCoreHistory: Updating History for Standard Load in frame %s", documentLoader()->url().string().ascii().data());
-
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (!documentLoader()->isClientRedirect()) {
-        if (!historyURL.isEmpty()) {
-            addBackForwardItemClippedAtTarget(true);
-            if (!needPrivacy) {
-                m_client->updateGlobalHistory();
-                m_documentLoader->setDidCreateGlobalHistoryEntry(true);
-                if (m_documentLoader->unreachableURL().isEmpty())
-                    m_client->updateGlobalHistoryRedirectLinks();
-            }
-            if (Page* page = m_frame->page())
-                page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
-        }
-    } else if (documentLoader()->unreachableURL().isEmpty() && m_currentHistoryItem) {
-        m_currentHistoryItem->setURL(documentLoader()->url());
-        m_currentHistoryItem->setFormInfoFromRequest(documentLoader()->request());
-    }
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-
-        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
-            m_client->updateGlobalHistoryRedirectLinks();
-    }
-}
-
-void FrameLoader::updateHistoryForClientRedirect()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
-    // webcore has closed the URL and saved away the form state.
-    if (m_currentHistoryItem) {
-        m_currentHistoryItem->clearDocumentState();
-        m_currentHistoryItem->clearScrollPoint();
-    }
-
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-    }
-}
-
-void FrameLoader::updateHistoryForBackForwardNavigation()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    // Must grab the current scroll position before disturbing it
-    saveScrollPositionAndViewStateToItem(m_previousHistoryItem.get());
-}
-
-void FrameLoader::updateHistoryForReload()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    if (m_currentHistoryItem) {
-        pageCache()->remove(m_currentHistoryItem.get());
-    
-        if (loadType() == FrameLoadTypeReload || loadType() == FrameLoadTypeReloadFromOrigin)
-            saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
-    
-        // Sometimes loading a page again leads to a different result because of cookies. Bugzilla 4072
-        if (documentLoader()->unreachableURL().isEmpty())
-            m_currentHistoryItem->setURL(documentLoader()->requestURL());
-    }
-}
-
-void FrameLoader::updateHistoryForRedirectWithLockedBackForwardList()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", documentLoader()->title().utf8().data());
-#endif
-    
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (documentLoader()->isClientRedirect()) {
-        if (!m_currentHistoryItem && !m_frame->tree()->parent()) {
-            if (!historyURL.isEmpty()) {
-                addBackForwardItemClippedAtTarget(true);
-                if (!needPrivacy) {
-                    m_client->updateGlobalHistory();
-                    m_documentLoader->setDidCreateGlobalHistoryEntry(true);
-                    if (m_documentLoader->unreachableURL().isEmpty())
-                        m_client->updateGlobalHistoryRedirectLinks();
-                }
-                if (Page* page = m_frame->page())
-                    page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
-            }
-        }
-        if (m_currentHistoryItem) {
-            m_currentHistoryItem->setURL(documentLoader()->url());
-            m_currentHistoryItem->setFormInfoFromRequest(documentLoader()->request());
-        }
-    } else {
-        Frame* parentFrame = m_frame->tree()->parent();
-        if (parentFrame && parentFrame->loader()->m_currentHistoryItem)
-            parentFrame->loader()->m_currentHistoryItem->setChildItem(createHistoryItem(true));
-    }
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-
-        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
-            m_client->updateGlobalHistoryRedirectLinks();
-    }
-}
-
-void FrameLoader::updateHistoryForCommit()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", documentLoader()->title().utf8().data());
-#endif
-    FrameLoadType type = loadType();
-    if (isBackForwardLoadType(type) ||
-        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !provisionalDocumentLoader()->unreachableURL().isEmpty())) {
-        // Once committed, we want to use current item for saving DocState, and
-        // the provisional item for restoring state.
-        // Note previousItem must be set before we close the URL, which will
-        // happen when the data source is made non-provisional below
-        m_previousHistoryItem = m_currentHistoryItem;
-        ASSERT(m_provisionalHistoryItem);
-        m_currentHistoryItem = m_provisionalHistoryItem;
-        m_provisionalHistoryItem = 0;
-    }
-}
-
-void FrameLoader::updateHistoryForAnchorScroll()
-{
-    if (m_URL.isEmpty())
-        return;
-
-    Settings* settings = m_frame->settings();
-    if (!settings || settings->privateBrowsingEnabled())
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    page->group().addVisitedLink(m_URL);
-}
-
-// Walk the frame tree, telling all frames to save their form state into their current
-// history item.
-void FrameLoader::saveDocumentAndScrollState()
-{
-    for (Frame* frame = m_frame; frame; frame = frame->tree()->traverseNext(m_frame)) {
-        frame->loader()->saveDocumentState();
-        frame->loader()->saveScrollPositionAndViewStateToItem(frame->loader()->currentHistoryItem());
-    }
-}
-
-HistoryItem* FrameLoader::currentHistoryItem()
-{
-    return m_currentHistoryItem.get();
-}
-
-void FrameLoader::setCurrentHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_currentHistoryItem = item;
-}
-
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
 {
     m_client->setMainDocumentError(loader, error);
@@ -5053,116 +3817,11 @@ ResourceError FrameLoader::fileDoesNotExistError(const ResourceResponse& respons
     return m_client->fileDoesNotExistError(response);    
 }
 
-void FrameLoader::didFinishLoad(ResourceLoader* loader)
-{    
-    if (Page* page = m_frame->page())
-        page->progress()->completeProgress(loader->identifier());
-    dispatchDidFinishLoading(loader->documentLoader(), loader->identifier());
-}
-
 bool FrameLoader::shouldUseCredentialStorage(ResourceLoader* loader)
 {
     return m_client->shouldUseCredentialStorage(loader->documentLoader(), loader->identifier());
 }
 
-void FrameLoader::didReceiveAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
-{
-    m_client->dispatchDidReceiveAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
-}
-
-void FrameLoader::didCancelAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
-{
-    m_client->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
-}
-
-PolicyCheck::PolicyCheck()
-    : m_navigationFunction(0)
-    , m_newWindowFunction(0)
-    , m_contentFunction(0)
-{
-}
-
-void PolicyCheck::clear()
-{
-    clearRequest();
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    NavigationPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = String();
-
-    m_navigationFunction = function;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = frameName;
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = function;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(ContentPolicyDecisionFunction function, void* argument)
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = function;
-    m_argument = argument;
-}
-
-void PolicyCheck::call(bool shouldContinue)
-{
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
-    ASSERT(!m_contentFunction);
-}
-
-void PolicyCheck::call(PolicyAction action)
-{
-    ASSERT(!m_navigationFunction);
-    ASSERT(!m_newWindowFunction);
-    ASSERT(m_contentFunction);
-    m_contentFunction(m_argument, action);
-}
-
-void PolicyCheck::clearRequest()
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-}
-
-void PolicyCheck::cancel()
-{
-    clearRequest();
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
-    if (m_contentFunction)
-        m_contentFunction(m_argument, PolicyIgnore);
-}
-
 void FrameLoader::setTitle(const String& title)
 {
     documentLoader()->setTitle(title);
@@ -5219,7 +3878,7 @@ PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTML
 
     if (!codeBaseURLString.isEmpty()) {
         KURL codeBaseURL = completeURL(codeBaseURLString);
-        if (!canLoad(codeBaseURL, String(), element->document())) {
+        if (!SecurityOrigin::canLoad(codeBaseURL, String(), element->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
             return 0;
         }
@@ -5243,8 +3902,7 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
 
     if (loader == m_documentLoader) {
         // Must update the entries in the back-forward list too.
-        if (m_currentHistoryItem)
-            m_currentHistoryItem->setTitle(loader->title());
+        history()->setCurrentItemTitle(loader->title());
         // This must go through the WebFrame because it has the right notion of the current b/f item.
         m_client->setTitle(loader->title(), loader->urlForHistory());
         m_client->setMainFrameDocumentReady(true); // update observers with new DOMDocument
@@ -5269,63 +3927,6 @@ void FrameLoader::dispatchDidCommitLoad()
 #endif
 }
 
-void FrameLoader::dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-    m_client->assignIdentifierToInitialRequest(identifier, loader, request);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
-#endif
-}
-
-void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
-{
-    StringImpl* oldRequestURL = request.url().string().impl();
-    m_documentLoader->didTellClientAboutLoad(request.url());
-
-    m_client->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
-
-    // If the URL changed, then we want to put that new URL in the "did tell client" set too.
-    if (!request.isNull() && oldRequestURL != request.url().string().impl())
-        m_documentLoader->didTellClientAboutLoad(request.url());
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
-#endif
-}
-
-void FrameLoader::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
-{
-    m_client->dispatchDidReceiveResponse(loader, identifier, r);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(loader, identifier, r);
-#endif
-}
-
-void FrameLoader::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
-{
-    m_client->dispatchDidReceiveContentLength(loader, identifier, length);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
-#endif
-}
-
-void FrameLoader::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
-{
-    m_client->dispatchDidFinishLoading(loader, identifier);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didFinishLoading(loader, identifier);
-#endif
-}
-
 void FrameLoader::tellClientAboutPastMemoryCacheLoads()
 {
     ASSERT(m_frame->page());
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index 4b4959b..bf0eebc 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -32,6 +32,11 @@
 
 #include "CachePolicy.h"
 #include "FrameLoaderTypes.h"
+#include "HistoryController.h"
+#include "PolicyCallback.h"
+#include "PolicyChecker.h"
+#include "RedirectScheduler.h"
+#include "ResourceLoadNotifier.h"
 #include "ResourceRequest.h"
 #include "ThreadableLoader.h"
 #include "Timer.h"
@@ -39,603 +44,465 @@
 
 namespace WebCore {
 
-    class Archive;
-    class AuthenticationChallenge;
-    class CachedFrameBase;
-    class CachedPage;
-    class CachedResource;
-    class Document;
-    class DocumentLoader;
-    class Event;
-    class FormData;
-    class FormState;
-    class Frame;
-    class FrameLoaderClient;
-    class HistoryItem;
-    class HTMLAppletElement;
-    class HTMLFormElement;
-    class HTMLFrameOwnerElement;
-    class IconLoader;
-    class IntSize;
-    class NavigationAction;
-    class RenderPart;
-    class ResourceError;
-    class ResourceLoader;
-    class ResourceResponse;
-    class ScriptSourceCode;
-    class ScriptString;
-    class ScriptValue;
-    class SecurityOrigin;
-    class SharedBuffer;
-    class SubstituteData;
-    class TextResourceDecoder;
-    class Widget;
-
-    struct FrameLoadRequest;
-    struct ScheduledRedirection;
-    struct WindowFeatures;
-
-    bool isBackForwardLoadType(FrameLoadType);
-
-    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
-
-    class PolicyCheck {
-    public:
-        PolicyCheck();
-
-        void clear();
-        void set(const ResourceRequest&, PassRefPtr<FormState>,
-            NavigationPolicyDecisionFunction, void* argument);
-        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
-            NewWindowPolicyDecisionFunction, void* argument);
-        void set(ContentPolicyDecisionFunction, void* argument);
-
-        const ResourceRequest& request() const { return m_request; }
-        void clearRequest();
-
-        void call(bool shouldContinue);
-        void call(PolicyAction);
-        void cancel();
-
-    private:
-        ResourceRequest m_request;
-        RefPtr<FormState> m_formState;
-        String m_frameName;
-
-        NavigationPolicyDecisionFunction m_navigationFunction;
-        NewWindowPolicyDecisionFunction m_newWindowFunction;
-        ContentPolicyDecisionFunction m_contentFunction;
-        void* m_argument;
-    };
-
-    class FrameLoader : public Noncopyable {
-    public:
-        FrameLoader(Frame*, FrameLoaderClient*);
-        ~FrameLoader();
-
-        void init();
-
-        Frame* frame() const { return m_frame; }
-
-        // FIXME: This is not cool, people. There are too many different functions that all start loads.
-        // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
-        // the logic by extracting common code paths.
-
-        void prepareForLoadStart();
-        void setupForReplace();
-        void setupForReplaceByMIMEType(const String& newMIMEType);
-
-        void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
-
-        void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
-            PassRefPtr<Event>, PassRefPtr<FormState>);
-
-        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
-        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
-        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
-        
-        void loadArchive(PassRefPtr<Archive>);
-
-        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
-        // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document*);
-        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
-        static void reportLocalLoadFailed(Frame*, const String& url);
-
-        static bool shouldHideReferrer(const KURL&, const String& referrer);
-
-        // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
-        Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
-
-        unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
-
-        bool canHandleRequest(const ResourceRequest&);
-
-        // Also not cool.
-        void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
-        void stopForUserCancel(bool deferCheckLoadComplete = false);
-
-        bool isLoadingMainResource() const { return m_isLoadingMainResource; }
-        bool isLoading() const;
-        bool frameHasLoaded() const;
-
-        int numPendingOrLoadingRequests(bool recurse) const;
-        String referrer() const;
-        String outgoingReferrer() const;
-        String outgoingOrigin() const;
-
-        DocumentLoader* activeDocumentLoader() const;
-        DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
-        DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
-        DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
-        FrameState state() const { return m_state; }
-        static double timeOfLastCompletedLoad();
-
-        bool shouldUseCredentialStorage(ResourceLoader*);
-        void didReceiveAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
-        void didCancelAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
-        
-        void assignIdentifierToInitialRequest(unsigned long identifier, const ResourceRequest&);
-        void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
-        void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
-        void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
-        void didFinishLoad(ResourceLoader*);
-        void didFailToLoad(ResourceLoader*, const ResourceError&);
-        void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
-        const ResourceRequest& originalRequest() const;
-        const ResourceRequest& initialRequest() const;
-        void receivedMainResourceError(const ResourceError&, bool isComplete);
-        void receivedData(const char*, int);
-
-        void handleFallbackContent();
-        bool isStopping() const;
+class Archive;
+class AuthenticationChallenge;
+class CachedFrameBase;
+class CachedPage;
+class CachedResource;
+class Document;
+class DocumentLoader;
+class Event;
+class FormData;
+class FormState;
+class Frame;
+class FrameLoaderClient;
+class HistoryItem;
+class HTMLAppletElement;
+class HTMLFormElement;
+class HTMLFrameOwnerElement;
+class IconLoader;
+class IntSize;
+class NavigationAction;
+class RenderPart;
+class ResourceError;
+class ResourceLoader;
+class ResourceResponse;
+class ScriptSourceCode;
+class ScriptString;
+class ScriptValue;
+class SecurityOrigin;
+class SharedBuffer;
+class SubstituteData;
+class TextResourceDecoder;
+class Widget;
+
+struct FrameLoadRequest;
+struct WindowFeatures;
+
+bool isBackForwardLoadType(FrameLoadType);
+
+class FrameLoader : public Noncopyable {
+public:
+    FrameLoader(Frame*, FrameLoaderClient*);
+    ~FrameLoader();
+
+    void init();
+
+    Frame* frame() const { return m_frame; }
+
+    PolicyChecker* policyChecker() const { return &m_policyChecker; }
+    HistoryController* history() const { return &m_history; }
+    ResourceLoadNotifier* notifier() const { return &m_notifer; }
+
+    // FIXME: This is not cool, people. There are too many different functions that all start loads.
+    // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
+    // the logic by extracting common code paths.
+
+    void prepareForLoadStart();
+    void setupForReplace();
+    void setupForReplaceByMIMEType(const String& newMIMEType);
+
+    void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
+
+    void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
+        PassRefPtr<Event>, PassRefPtr<FormState>, ReferrerPolicy);
+
+    void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+    void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+    void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
+    
+    void loadArchive(PassRefPtr<Archive>);
 
-        void finishedLoading();
+    static void reportLocalLoadFailed(Frame*, const String& url);
 
-        ResourceError cancelledError(const ResourceRequest&) const;
-        ResourceError fileDoesNotExistError(const ResourceResponse&) const;
-        ResourceError blockedError(const ResourceRequest&) const;
-        ResourceError cannotShowURLError(const ResourceRequest&) const;
+    // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
+    Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
-        void cannotShowMIMEType(const ResourceResponse&);
-        ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
+    unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
 
-        bool isHostedByObjectElement() const;
-        bool isLoadingMainFrame() const;
-        bool canShowMIMEType(const String& MIMEType) const;
-        bool representationExistsForURLScheme(const String& URLScheme);
-        String generatedMIMETypeForURLScheme(const String& URLScheme);
+    bool canHandleRequest(const ResourceRequest&);
 
-        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
-        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
-        void cancelContentPolicyCheck();
+    // Also not cool.
+    void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
+    void stopForUserCancel(bool deferCheckLoadComplete = false);
 
-        void reload(bool endToEndReload = false);
-        void reloadWithOverrideEncoding(const String& overrideEncoding);
+    bool isLoadingMainResource() const { return m_isLoadingMainResource; }
+    bool isLoading() const;
+    bool frameHasLoaded() const;
 
-        void didReceiveServerRedirectForProvisionalLoadForFrame();
-        void finishedLoadingDocument(DocumentLoader*);
-        void committedLoad(DocumentLoader*, const char*, int);
-        bool isReplacing() const;
-        void setReplacing();
-        void revertToProvisional(DocumentLoader*);
-        void setMainDocumentError(DocumentLoader*, const ResourceError&);
-        void mainReceivedCompleteError(DocumentLoader*, const ResourceError&);
-        bool subframeIsLoading() const;
-        void willChangeTitle(DocumentLoader*);
-        void didChangeTitle(DocumentLoader*);
+    int numPendingOrLoadingRequests(bool recurse) const;
+    String referrer() const;
+    String outgoingReferrer() const;
+    String outgoingOrigin() const;
 
-        FrameLoadType loadType() const;
-        CachePolicy subresourceCachePolicy() const;
+    DocumentLoader* activeDocumentLoader() const;
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
+    DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
+    FrameState state() const { return m_state; }
+    static double timeOfLastCompletedLoad();
 
-        void didFirstLayout();
-        bool firstLayoutDone() const;
+    bool shouldUseCredentialStorage(ResourceLoader*);
+    const ResourceRequest& originalRequest() const;
+    const ResourceRequest& initialRequest() const;
+    void receivedMainResourceError(const ResourceError&, bool isComplete);
+    void receivedData(const char*, int);
 
-        void didFirstVisuallyNonEmptyLayout();
+    bool willLoadMediaElementURL(KURL&);
 
-        void loadedResourceFromMemoryCache(const CachedResource*);
-        void tellClientAboutPastMemoryCacheLoads();
+    void handleFallbackContent();
+    bool isStopping() const;
 
-        void checkLoadComplete();
-        void detachFromParent();
-        void detachViewsAndDocumentLoader();
+    void finishedLoading();
 
-        void addExtraFieldsToSubresourceRequest(ResourceRequest&);
-        void addExtraFieldsToMainResourceRequest(ResourceRequest&);
-        
-        static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
+    ResourceError cancelledError(const ResourceRequest&) const;
+    ResourceError fileDoesNotExistError(const ResourceResponse&) const;
+    ResourceError blockedError(const ResourceRequest&) const;
+    ResourceError cannotShowURLError(const ResourceRequest&) const;
+    ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
 
-        FrameLoaderClient* client() const { return m_client; }
+    bool isHostedByObjectElement() const;
+    bool isLoadingMainFrame() const;
+    bool canShowMIMEType(const String& MIMEType) const;
+    bool representationExistsForURLScheme(const String& URLScheme);
+    String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void setDefersLoading(bool);
+    void reload(bool endToEndReload = false);
+    void reloadWithOverrideEncoding(const String& overrideEncoding);
 
-        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
-        void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture);
-        bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
+    void didReceiveServerRedirectForProvisionalLoadForFrame();
+    void finishedLoadingDocument(DocumentLoader*);
+    void committedLoad(DocumentLoader*, const char*, int);
+    bool isReplacing() const;
+    void setReplacing();
+    void revertToProvisional(DocumentLoader*);
+    void setMainDocumentError(DocumentLoader*, const ResourceError&);
+    void mainReceivedCompleteError(DocumentLoader*, const ResourceError&);
+    bool subframeIsLoading() const;
+    void willChangeTitle(DocumentLoader*);
+    void didChangeTitle(DocumentLoader*);
 
-        void submitForm(const char* action, const String& url,
-            PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
-            bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    FrameLoadType loadType() const;
+    CachePolicy subresourceCachePolicy() const;
 
-        void stop();
-        void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
-        bool closeURL();
+    void didFirstLayout();
+    bool firstLayoutDone() const;
 
-        void didExplicitOpen();
+    void didFirstVisuallyNonEmptyLayout();
 
-        KURL iconURL();
-        void commitIconURLToIconDatabase(const KURL&);
+    void loadedResourceFromMemoryCache(const CachedResource*);
+    void tellClientAboutPastMemoryCacheLoads();
 
-        KURL baseURL() const;
+    void checkLoadComplete();
+    void detachFromParent();
+    void detachViewsAndDocumentLoader();
 
-        bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
-        void scheduleHTTPRedirection(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
-        void scheduleRefresh(bool userGesture = false);
-        void scheduleHistoryNavigation(int steps);
+    void addExtraFieldsToSubresourceRequest(ResourceRequest&);
+    void addExtraFieldsToMainResourceRequest(ResourceRequest&);
+    
+    static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
 
-        bool canGoBackOrForward(int distance) const;
-        void goBackOrForward(int distance);
-        int getHistoryLength();
+    FrameLoaderClient* client() const { return m_client; }
 
-        void begin();
-        void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
+    void setDefersLoading(bool);
 
-        void write(const char* string, int length = -1, bool flush = false);
-        void write(const String&);
-        void end();
-        void endIfNotLoadingMainResource();
+    void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
+    void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy);
+    bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
 
-        void setEncoding(const String& encoding, bool userChosen);
-        String encoding() const;
+    void submitForm(const char* action, const String& url,
+        PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
+        bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
 
-        ScriptValue executeScript(const ScriptSourceCode&);
-        ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+    void stop();
+    void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
+    bool closeURL();
 
-        void gotoAnchor();
+    void didExplicitOpen();
 
-        void tokenizerProcessedData();
+    KURL iconURL();
+    void commitIconURLToIconDatabase(const KURL&);
 
-        void handledOnloadEvents();
-        String userAgent(const KURL&) const;
+    KURL baseURL() const;
 
-        PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
+    void replaceDocument(const String&);
 
-        void dispatchWindowObjectAvailable();
-        void dispatchDocumentElementAvailable();
-        void restoreDocumentState();
+    void begin();
+    void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
-        // Mixed content related functions.
-        static bool isMixedContent(SecurityOrigin* context, const KURL&);
-        void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
-        void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
+    void write(const char* string, int length = -1, bool flush = false);
+    void write(const String&);
+    void end();
+    void endIfNotLoadingMainResource();
 
-        Frame* opener();
-        void setOpener(Frame*);
-        bool openedByDOM() const;
-        void setOpenedByDOM();
+    void setEncoding(const String& encoding, bool userChosen);
+    String encoding() const;
 
-        bool isProcessingUserGesture();
+    void tokenizerProcessedData();
 
-        void resetMultipleFormSubmissionProtection();
+    void handledOnloadEvents();
+    String userAgent(const KURL&) const;
 
-        void addData(const char* bytes, int length);
+    PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
-        void checkCallImplicitClose();
+    void dispatchWindowObjectAvailable();
+    void dispatchDocumentElementAvailable();
 
-        void frameDetached();
+    // Mixed content related functions.
+    static bool isMixedContent(SecurityOrigin* context, const KURL&);
+    void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
+    void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
 
-        const KURL& url() const { return m_URL; }
+    Frame* opener();
+    void setOpener(Frame*);
 
-        void setResponseMIMEType(const String&);
-        const String& responseMIMEType() const;
+    bool isProcessingUserGesture();
 
-        bool containsPlugins() const;
+    void resetMultipleFormSubmissionProtection();
 
-        void loadDone();
-        void finishedParsing();
-        void checkCompleted();
+    void addData(const char* bytes, int length);
 
-        bool isComplete() const;
+    void checkCallImplicitClose();
 
-        bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
-            const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
+    void frameDetached();
 
-        KURL completeURL(const String& url);
+    const KURL& url() const { return m_URL; }
 
-        void cancelAndClear();
+    void setResponseMIMEType(const String&);
+    const String& responseMIMEType() const;
 
-        void setTitle(const String&);
+    bool containsPlugins() const;
 
-        void commitProvisionalLoad(PassRefPtr<CachedPage>);
-        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
+    void loadDone();
+    void finishedParsing();
+    void checkCompleted();
 
-        void goToItem(HistoryItem*, FrameLoadType);
-        void saveDocumentAndScrollState();
+    void checkDidPerformFirstNavigation();
 
-        HistoryItem* currentHistoryItem();
-        void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
+    bool isComplete() const;
 
-        enum LocalLoadPolicy {
-            AllowLocalLoadsForAll,  // No restriction on local loads.
-            AllowLocalLoadsForLocalAndSubstituteData,
-            AllowLocalLoadsForLocalOnly,
-        };
-        static void setLocalLoadPolicy(LocalLoadPolicy);
-        static bool restrictAccessToLocal();
-        static bool allowSubstituteDataAccessToLocal();
+    bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
+        const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
-        bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+    KURL completeURL(const String& url);
 
-        void iconLoadDecisionAvailable();
+    void cancelAndClear();
 
-        bool shouldAllowNavigation(Frame* targetFrame) const;
-        Frame* findFrameForNavigation(const AtomicString& name);
+    void setTitle(const String&);
 
-        void startIconLoader();
+    void commitProvisionalLoad(PassRefPtr<CachedPage>);
+    bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
 
-        void applyUserAgent(ResourceRequest& request);
+    bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+    bool committedFirstRealDocumentLoad() const { return m_committedFirstRealDocumentLoad; }
+    bool creatingInitialEmptyDocument() const { return m_creatingInitialEmptyDocument; }
 
-        bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
+    void iconLoadDecisionAvailable();
 
-        void open(CachedFrameBase&);
+    bool shouldAllowNavigation(Frame* targetFrame) const;
+    Frame* findFrameForNavigation(const AtomicString& name);
 
-    private:
-        PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
-        PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
+    void startIconLoader();
 
-        bool canCachePageContainingThisFrame();
-#ifndef NDEBUG
-        void logCanCachePageDecision();
-        bool logCanCacheFrameDecision(int indentLevel);
-#endif
+    void applyUserAgent(ResourceRequest& request);
 
-        void addBackForwardItemClippedAtTarget(bool doClip);
-        void restoreScrollPositionAndViewState();
-        void saveDocumentState();
-        void loadItem(HistoryItem*, FrameLoadType);
-        bool urlsMatchItem(HistoryItem*) const;
-        void invalidateCurrentItemCachedPage();
-        void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
-        bool childFramesMatchItem(HistoryItem*) const;
-
-        void updateHistoryForBackForwardNavigation();
-        void updateHistoryForReload();
-        void updateHistoryForStandardLoad();
-        void updateHistoryForRedirectWithLockedBackForwardList();
-        void updateHistoryForClientRedirect();
-        void updateHistoryForCommit();
-        void updateHistoryForAnchorScroll();
-    
-        void redirectionTimerFired(Timer<FrameLoader>*);
-        void checkTimerFired(Timer<FrameLoader>*);
-        
-        void cancelRedirection(bool newLoadInProgress = false);
+    bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
 
-        void started();
+    void open(CachedFrameBase&);
 
-        void completed();
+    // FIXME: Should these really be public?
+    void completed();
+    bool allAncestorsAreComplete() const; // including this
+    bool allChildrenAreComplete() const; // immediate children, not all descendants
+    void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+    void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+    void loadItem(HistoryItem*, FrameLoadType);
 
-        bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
-        bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
-        const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
-        
-        bool loadProvisionalItemFromCachedPage();
-        void cachePageForHistoryItem(HistoryItem*);
-        void pageHidden();
+    // FIXME: This is public because this asynchronous callback from the FrameLoaderClient
+    // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
+    // introduce a proper callback type for this function, we should make it private again.
+    void continueLoadAfterWillSubmitForm();
 
-        void receivedFirstData();
+private:
+    bool canCachePageContainingThisFrame();
+#ifndef NDEBUG
+    void logCanCachePageDecision();
+    bool logCanCacheFrameDecision(int indentLevel);
+#endif
 
-        void updateFirstPartyForCookies();
-        void setFirstPartyForCookies(const KURL&);
-        
-        void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
+    void checkTimerFired(Timer<FrameLoader>*);
 
-        // Also not cool.
-        void stopLoadingSubframes();
+    void started();
 
-        void clearProvisionalLoad();
-        void markLoadComplete();
-        void transitionToCommitted(PassRefPtr<CachedPage>);
-        void frameLoadCompleted();
+    bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
+    bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
+    const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
+    
+    bool loadProvisionalItemFromCachedPage();
+    void cachePageForHistoryItem(HistoryItem*);
+    void pageHidden();
 
-        void mainReceivedError(const ResourceError&, bool isComplete);
+    void receivedFirstData();
+
+    void updateFirstPartyForCookies();
+    void setFirstPartyForCookies(const KURL&);
+    
+    void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
 
-        void setLoadType(FrameLoadType);
+    // Also not cool.
+    void stopLoadingSubframes();
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
+    void clearProvisionalLoad();
+    void markLoadComplete();
+    void transitionToCommitted(PassRefPtr<CachedPage>);
+    void frameLoadCompleted();
 
-        void continueAfterNavigationPolicy(PolicyAction);
-        void continueAfterNewWindowPolicy(PolicyAction);
-        void continueAfterContentPolicy(PolicyAction);
-        void continueLoadAfterWillSubmitForm(PolicyAction = PolicyUse);
+    void mainReceivedError(const ResourceError&, bool isComplete);
 
-        static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
-        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
-        void addHistoryItemForFragmentScroll();
+    void setLoadType(FrameLoadType);
 
-        void stopPolicyCheck();
+    static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
 
-        void checkLoadCompleteForThisFrame();
+    void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
 
-        void setDocumentLoader(DocumentLoader*);
-        void setPolicyDocumentLoader(DocumentLoader*);
-        void setProvisionalDocumentLoader(DocumentLoader*);
+    bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
 
-        void setState(FrameState);
+    void checkLoadCompleteForThisFrame();
 
-        void closeOldDataSources();
-        void open(CachedPage&);
+    void setDocumentLoader(DocumentLoader*);
+    void setPolicyDocumentLoader(DocumentLoader*);
+    void setProvisionalDocumentLoader(DocumentLoader*);
 
-        void updateHistoryAfterClientRedirect();
+    void setState(FrameState);
 
-        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
+    void closeOldDataSources();
+    void open(CachedPage&);
 
-        bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
-        void handleUnimplementablePolicy(const ResourceError&);
+    void updateHistoryAfterClientRedirect();
 
-        void scheduleRedirection(PassOwnPtr<ScheduledRedirection>);
-        void startRedirectionTimer();
-        void stopRedirectionTimer();
+    void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
-        void dispatchDidCommitLoad();
-        void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-        void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-        void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-        void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
-        void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
+    bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
 
-        static bool isLocationChange(const ScheduledRedirection&);
-        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void dispatchDidCommitLoad();
 
-        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
-        void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+    void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
+    void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
 
-        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
-            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
+    void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
+        bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
 
-        void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
-            const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
-        void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
-            bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
+    void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+        const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+        bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
-        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
+    bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 
-        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
-        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
+    void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
 
-        void recursiveCheckLoadComplete();
+    void recursiveCheckLoadComplete();
 
-        void detachChildren();
-        void closeAndRemoveChild(Frame*);
+    void detachChildren();
+    void closeAndRemoveChild(Frame*);
 
-        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
+    Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-        // Returns true if argument is a JavaScript URL.
-        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+    void scrollToAnchor(const KURL&);
 
-        bool gotoAnchor(const String& name); // returns true if the anchor was found
-        void scrollToAnchor(const KURL&);
+    void provisionalLoadStarted();
 
-        void provisionalLoadStarted();
+    bool canCachePage();
 
-        bool canCachePage();
+    bool didOpenURL(const KURL&);
 
-        bool didOpenURL(const KURL&);
+    void scheduleCheckCompleted();
+    void scheduleCheckLoadComplete();
+    void startCheckCompleteTimer();
 
-        void scheduleCheckCompleted();
-        void scheduleCheckLoadComplete();
-        void startCheckCompleteTimer();
+    KURL originalRequestURL() const;
 
-        KURL originalRequestURL() const;
+    bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
-        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
+    Frame* m_frame;
+    FrameLoaderClient* m_client;
 
-        void saveScrollPositionAndViewStateToItem(HistoryItem*);
+    mutable PolicyChecker m_policyChecker;
+    mutable HistoryController m_history;
+    mutable ResourceLoadNotifier m_notifer;
 
-        bool allAncestorsAreComplete() const; // including this
-        bool allChildrenAreComplete() const; // immediate children, not all descendants
+    FrameState m_state;
+    FrameLoadType m_loadType;
 
-        Frame* m_frame;
-        FrameLoaderClient* m_client;
+    // Document loaders for the three phases of frame loading. Note that while 
+    // a new request is being loaded, the old document loader may still be referenced.
+    // E.g. while a new request is in the "policy" state, the old document loader may
+    // be consulted in particular as it makes sense to imply certain settings on the new loader.
+    RefPtr<DocumentLoader> m_documentLoader;
+    RefPtr<DocumentLoader> m_provisionalDocumentLoader;
+    RefPtr<DocumentLoader> m_policyDocumentLoader;
 
-        FrameState m_state;
-        FrameLoadType m_loadType;
+    bool m_delegateIsHandlingProvisionalLoadError;
 
-        // Document loaders for the three phases of frame loading. Note that while 
-        // a new request is being loaded, the old document loader may still be referenced.
-        // E.g. while a new request is in the "policy" state, the old document loader may
-        // be consulted in particular as it makes sense to imply certain settings on the new loader.
-        RefPtr<DocumentLoader> m_documentLoader;
-        RefPtr<DocumentLoader> m_provisionalDocumentLoader;
-        RefPtr<DocumentLoader> m_policyDocumentLoader;
+    bool m_firstLayoutDone;
+    bool m_quickRedirectComing;
+    bool m_sentRedirectNotification;
+    bool m_inStopAllLoaders;
 
-        // This identifies the type of navigation action which prompted this load. Note 
-        // that WebKit conveys this value as the WebActionNavigationTypeKey value
-        // on navigation action delegate callbacks.
-        FrameLoadType m_policyLoadType;
-        PolicyCheck m_policyCheck;
+    String m_outgoingReferrer;
 
-        bool m_delegateIsHandlingProvisionalLoadError;
-        bool m_delegateIsDecidingNavigationPolicy;
-        bool m_delegateIsHandlingUnimplementablePolicy;
+    bool m_isExecutingJavaScriptFormAction;
 
-        bool m_firstLayoutDone;
-        bool m_quickRedirectComing;
-        bool m_sentRedirectNotification;
-        bool m_inStopAllLoaders;
+    String m_responseMIMEType;
 
-        String m_outgoingReferrer;
+    bool m_didCallImplicitClose;
+    bool m_wasUnloadEventEmitted;
+    bool m_unloadEventBeingDispatched;
+    bool m_isComplete;
+    bool m_isLoadingMainResource;
 
-        bool m_isExecutingJavaScriptFormAction;
-        bool m_isRunningScript;
+    KURL m_URL;
+    KURL m_workingURL;
 
-        String m_responseMIMEType;
+    OwnPtr<IconLoader> m_iconLoader;
+    bool m_mayLoadIconLater;
 
-        bool m_didCallImplicitClose;
-        bool m_wasUnloadEventEmitted;
-        bool m_unloadEventBeingDispatched;
-        bool m_isComplete;
-        bool m_isLoadingMainResource;
+    bool m_cancellingWithLoadInProgress;
 
-        KURL m_URL;
-        KURL m_workingURL;
+    bool m_needsClear;
+    bool m_receivedData;
 
-        OwnPtr<IconLoader> m_iconLoader;
-        bool m_mayLoadIconLater;
+    bool m_encodingWasChosenByUser;
+    String m_encoding;
+    RefPtr<TextResourceDecoder> m_decoder;
 
-        bool m_cancellingWithLoadInProgress;
+    bool m_containsPlugIns;
 
-        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+    KURL m_submittedFormURL;
 
-        bool m_needsClear;
-        bool m_receivedData;
+    Timer<FrameLoader> m_checkTimer;
+    bool m_shouldCallCheckCompleted;
+    bool m_shouldCallCheckLoadComplete;
 
-        bool m_encodingWasChosenByUser;
-        String m_encoding;
-        RefPtr<TextResourceDecoder> m_decoder;
+    Frame* m_opener;
+    HashSet<Frame*> m_openedFrames;
 
-        bool m_containsPlugIns;
+    bool m_creatingInitialEmptyDocument;
+    bool m_isDisplayingInitialEmptyDocument;
+    bool m_committedFirstRealDocumentLoad;
 
-        KURL m_submittedFormURL;
+    bool m_didPerformFirstNavigation;
+    bool m_loadingFromCachedPage;
+    bool m_suppressOpenerInNewFrame;
     
-        Timer<FrameLoader> m_redirectionTimer;
-        Timer<FrameLoader> m_checkTimer;
-        bool m_shouldCallCheckCompleted;
-        bool m_shouldCallCheckLoadComplete;
-
-        Frame* m_opener;
-        HashSet<Frame*> m_openedFrames;
-
-        bool m_openedByDOM;
-
-        bool m_creatingInitialEmptyDocument;
-        bool m_isDisplayingInitialEmptyDocument;
-        bool m_committedFirstRealDocumentLoad;
-
-        RefPtr<HistoryItem> m_currentHistoryItem;
-        RefPtr<HistoryItem> m_previousHistoryItem;
-        RefPtr<HistoryItem> m_provisionalHistoryItem;
-        
-        bool m_didPerformFirstNavigation;
-        bool m_loadingFromCachedPage;
-        
 #ifndef NDEBUG
-        bool m_didDispatchDidCommitLoad;
+    bool m_didDispatchDidCommitLoad;
 #endif
-    };
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index 5ba4b10..2042b32 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -60,6 +60,7 @@ namespace WebCore {
     class KURL;
     class NavigationAction;
     class PluginView;
+    class PolicyChecker;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
@@ -72,7 +73,7 @@ namespace WebCore {
     class String;
     class Widget;
 
-    typedef void (FrameLoader::*FramePolicyFunction)(PolicyAction);
+    typedef void (PolicyChecker::*FramePolicyFunction)(PolicyAction);
 
     class FrameLoaderClient {
     public:
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
index 76299f5..e7d51c7 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
@@ -87,6 +87,11 @@ namespace WebCore {
         UnloadEventPolicyUnloadOnly,
         UnloadEventPolicyUnloadAndPageHide
     };
+
+    enum ReferrerPolicy {
+        SendReferrer,
+        NoReferrer
+    };
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp b/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
new file mode 100644
index 0000000..501640a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/HistoryController.cpp
@@ -0,0 +1,627 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HistoryController.h"
+
+#include "CachedPage.h"
+#include "CString.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "HistoryItem.h"
+#include "Logging.h"
+#include "Page.h"
+#include "PageCache.h"
+#include "PageGroup.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+HistoryController::HistoryController(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+HistoryController::~HistoryController()
+{
+}
+
+void HistoryController::saveScrollPositionAndViewStateToItem(HistoryItem* item)
+{
+    if (!item || !m_frame->view())
+        return;
+        
+    item->setScrollPoint(m_frame->view()->scrollPosition());
+    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
+    m_frame->loader()->client()->saveViewStateToItem(item);
+}
+
+/*
+ There is a race condition between the layout and load completion that affects restoring the scroll position.
+ We try to restore the scroll position at both the first layout and upon load completion.
+ 
+ 1) If first layout happens before the load completes, we want to restore the scroll position then so that the
+ first time we draw the page is already scrolled to the right place, instead of starting at the top and later
+ jumping down.  It is possible that the old scroll position is past the part of the doc laid out so far, in
+ which case the restore silent fails and we will fix it in when we try to restore on doc completion.
+ 2) If the layout happens after the load completes, the attempt to restore at load completion time silently
+ fails.  We then successfully restore it when the layout happens.
+*/
+void HistoryController::restoreScrollPositionAndViewState()
+{
+    if (!m_frame->loader()->committedFirstRealDocumentLoad())
+        return;
+
+    ASSERT(m_currentItem);
+    
+    // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
+    // One counterexample is <rdar://problem/4917290>
+    // For now, to cover this issue in release builds, there is no technical harm to returning
+    // early and from a user standpoint - as in the above radar - the previous page load failed 
+    // so there *is* no scroll or view state to restore!
+    if (!m_currentItem)
+        return;
+    
+    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling
+    // through to the client. It's currently used only for the PDF view on Mac.
+    m_frame->loader()->client()->restoreViewState();
+    
+    if (FrameView* view = m_frame->view())
+        if (!view->wasScrolledByUser())
+            view->setScrollPosition(m_currentItem->scrollPoint());
+}
+
+void HistoryController::updateBackForwardListForFragmentScroll()
+{
+    updateBackForwardListClippedAtTarget(false);
+}
+
+void HistoryController::saveDocumentState()
+{
+    // FIXME: Reading this bit of FrameLoader state here is unfortunate.  I need to study
+    // this more to see if we can remove this dependency.
+    if (m_frame->loader()->creatingInitialEmptyDocument())
+        return;
+
+    // For a standard page load, we will have a previous item set, which will be used to
+    // store the form state.  However, in some cases we will have no previous item, and
+    // the current item is the right place to save the state.  One example is when we
+    // detach a bunch of frames because we are navigating from a site with frames to
+    // another site.  Another is when saving the frame state of a frame that is not the
+    // target of the current navigation (if we even decide to save with that granularity).
+
+    // Because of previousItem's "masking" of currentItem for this purpose, it's important
+    // that previousItem be cleared at the end of a page transition.  We leverage the
+    // checkLoadComplete recursion to achieve this goal.
+
+    HistoryItem* item = m_previousItem ? m_previousItem.get() : m_currentItem.get();
+    if (!item)
+        return;
+
+    Document* document = m_frame->document();
+    ASSERT(document);
+    
+    if (item->isCurrentDocument(document)) {
+        LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
+        item->setDocumentState(document->formElementsState());
+    }
+}
+
+// Walk the frame tree, telling all frames to save their form state into their current
+// history item.
+void HistoryController::saveDocumentAndScrollState()
+{
+    for (Frame* frame = m_frame; frame; frame = frame->tree()->traverseNext(m_frame)) {
+        frame->loader()->history()->saveDocumentState();
+        frame->loader()->history()->saveScrollPositionAndViewStateToItem(frame->loader()->history()->currentItem());
+    }
+}
+
+void HistoryController::restoreDocumentState()
+{
+    Document* doc = m_frame->document();
+        
+    HistoryItem* itemToRestore = 0;
+    
+    switch (m_frame->loader()->loadType()) {
+        case FrameLoadTypeReload:
+        case FrameLoadTypeReloadFromOrigin:
+        case FrameLoadTypeSame:
+        case FrameLoadTypeReplace:
+            break;
+        case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
+        case FrameLoadTypeForward:
+        case FrameLoadTypeIndexedBackForward:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
+        case FrameLoadTypeStandard:
+            itemToRestore = m_currentItem.get(); 
+    }
+    
+    if (!itemToRestore)
+        return;
+
+    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
+    doc->setStateForNewFormElements(itemToRestore->documentState());
+}
+
+void HistoryController::invalidateCurrentItemCachedPage()
+{
+    // When we are pre-commit, the currentItem is where the pageCache data resides    
+    CachedPage* cachedPage = pageCache()->get(currentItem());
+
+    // FIXME: This is a grotesque hack to fix <rdar://problem/4059059> Crash in RenderFlow::detach
+    // Somehow the PageState object is not properly updated, and is holding onto a stale document.
+    // Both Xcode and FileMaker see this crash, Safari does not.
+    
+    ASSERT(!cachedPage || cachedPage->document() == m_frame->document());
+    if (cachedPage && cachedPage->document() == m_frame->document()) {
+        cachedPage->document()->setInPageCache(false);
+        cachedPage->clear();
+    }
+    
+    if (cachedPage)
+        pageCache()->remove(currentItem());
+}
+
+// Main funnel for navigating to a previous location (back/forward, non-search snap-back)
+// This includes recursion to handle loading into framesets properly
+void HistoryController::goToItem(HistoryItem* targetItem, FrameLoadType type)
+{
+    ASSERT(!m_frame->tree()->parent());
+    
+    // shouldGoToHistoryItem is a private delegate method. This is needed to fix:
+    // <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
+    // Ultimately, history item navigations should go through the policy delegate. That's covered in:
+    // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    if (!m_frame->loader()->client()->shouldGoToHistoryItem(targetItem))
+        return;
+
+    // Set the BF cursor before commit, which lets the user quickly click back/forward again.
+    // - plus, it only makes sense for the top level of the operation through the frametree,
+    // as opposed to happening for some/one of the page commits that might happen soon
+    BackForwardList* bfList = page->backForwardList();
+    HistoryItem* currentItem = bfList->currentItem();    
+    bfList->goToItem(targetItem);
+    Settings* settings = m_frame->settings();
+    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
+    recursiveGoToItem(targetItem, currentItem, type);
+}
+
+// Walk the frame tree and ensure that the URLs match the URLs in the item.
+bool HistoryController::urlsMatchItem(HistoryItem* item) const
+{
+    const KURL& currentURL = m_frame->loader()->documentLoader()->url();
+    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
+        return false;
+
+    const HistoryItemVector& childItems = item->children();
+
+    unsigned size = childItems.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Frame* childFrame = m_frame->tree()->child(childItems[i]->target());
+        if (childFrame && !childFrame->loader()->history()->urlsMatchItem(childItems[i].get()))
+            return false;
+    }
+
+    return true;
+}
+
+void HistoryController::updateForBackForwardNavigation()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    // Must grab the current scroll position before disturbing it
+    saveScrollPositionAndViewStateToItem(m_previousItem.get());
+}
+
+void HistoryController::updateForReload()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    if (m_currentItem) {
+        pageCache()->remove(m_currentItem.get());
+    
+        if (m_frame->loader()->loadType() == FrameLoadTypeReload || m_frame->loader()->loadType() == FrameLoadTypeReloadFromOrigin)
+            saveScrollPositionAndViewStateToItem(m_currentItem.get());
+    
+        // Sometimes loading a page again leads to a different result because of cookies. Bugzilla 4072
+        if (m_frame->loader()->documentLoader()->unreachableURL().isEmpty())
+            m_currentItem->setURL(m_frame->loader()->documentLoader()->requestURL());
+    }
+}
+
+// There are 3 things you might think of as "history", all of which are handled by these functions.
+//
+//     1) Back/forward: The m_currentItem is part of this mechanism.
+//     2) Global history: Handled by the client.
+//     3) Visited links: Handled by the PageGroup.
+
+void HistoryController::updateForStandardLoad()
+{
+    LOG(History, "WebCoreHistory: Updating History for Standard Load in frame %s", m_frame->loader()->documentLoader()->url().string().ascii().data());
+
+    FrameLoader* frameLoader = m_frame->loader();
+
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = frameLoader->documentLoader()->urlForHistory();
+
+    if (!frameLoader->documentLoader()->isClientRedirect()) {
+        if (!historyURL.isEmpty()) {
+            updateBackForwardListClippedAtTarget(true);
+            if (!needPrivacy) {
+                frameLoader->client()->updateGlobalHistory();
+                frameLoader->documentLoader()->setDidCreateGlobalHistoryEntry(true);
+                if (frameLoader->documentLoader()->unreachableURL().isEmpty())
+                    frameLoader->client()->updateGlobalHistoryRedirectLinks();
+            }
+            if (Page* page = m_frame->page())
+                page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
+        }
+    } else if (frameLoader->documentLoader()->unreachableURL().isEmpty() && m_currentItem) {
+        m_currentItem->setURL(frameLoader->documentLoader()->url());
+        m_currentItem->setFormInfoFromRequest(frameLoader->documentLoader()->request());
+    }
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+
+        if (!frameLoader->documentLoader()->didCreateGlobalHistoryEntry() && frameLoader->documentLoader()->unreachableURL().isEmpty() && !frameLoader->url().isEmpty())
+            frameLoader->client()->updateGlobalHistoryRedirectLinks();
+    }
+}
+
+void HistoryController::updateForRedirectWithLockedBackForwardList()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+    
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = m_frame->loader()->documentLoader()->urlForHistory();
+
+    if (m_frame->loader()->documentLoader()->isClientRedirect()) {
+        if (!m_currentItem && !m_frame->tree()->parent()) {
+            if (!historyURL.isEmpty()) {
+                updateBackForwardListClippedAtTarget(true);
+                if (!needPrivacy) {
+                    m_frame->loader()->client()->updateGlobalHistory();
+                    m_frame->loader()->documentLoader()->setDidCreateGlobalHistoryEntry(true);
+                    if (m_frame->loader()->documentLoader()->unreachableURL().isEmpty())
+                        m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
+                }
+                if (Page* page = m_frame->page())
+                    page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
+            }
+        }
+        if (m_currentItem) {
+            m_currentItem->setURL(m_frame->loader()->documentLoader()->url());
+            m_currentItem->setFormInfoFromRequest(m_frame->loader()->documentLoader()->request());
+        }
+    } else {
+        Frame* parentFrame = m_frame->tree()->parent();
+        if (parentFrame && parentFrame->loader()->history()->m_currentItem)
+            parentFrame->loader()->history()->m_currentItem->setChildItem(createItem(true));
+    }
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+
+        if (!m_frame->loader()->documentLoader()->didCreateGlobalHistoryEntry() && m_frame->loader()->documentLoader()->unreachableURL().isEmpty() && !m_frame->loader()->url().isEmpty())
+            m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
+    }
+}
+
+void HistoryController::updateForClientRedirect()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
+    // webcore has closed the URL and saved away the form state.
+    if (m_currentItem) {
+        m_currentItem->clearDocumentState();
+        m_currentItem->clearScrollPoint();
+    }
+
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = m_frame->loader()->documentLoader()->urlForHistory();
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+    }
+}
+
+void HistoryController::updateForCommit()
+{
+    FrameLoader* frameLoader = m_frame->loader();
+#if !LOG_DISABLED
+    if (frameLoader->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().utf8().data());
+#endif
+    FrameLoadType type = frameLoader->loadType();
+    if (isBackForwardLoadType(type) ||
+        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
+        // Once committed, we want to use current item for saving DocState, and
+        // the provisional item for restoring state.
+        // Note previousItem must be set before we close the URL, which will
+        // happen when the data source is made non-provisional below
+        m_previousItem = m_currentItem;
+        ASSERT(m_provisionalItem);
+        m_currentItem = m_provisionalItem;
+        m_provisionalItem = 0;
+    }
+}
+
+void HistoryController::updateForAnchorScroll()
+{
+    if (m_frame->loader()->url().isEmpty())
+        return;
+
+    Settings* settings = m_frame->settings();
+    if (!settings || settings->privateBrowsingEnabled())
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    page->group().addVisitedLink(m_frame->loader()->url());
+}
+
+void HistoryController::updateForFrameLoadCompleted()
+{
+    // Even if already complete, we might have set a previous item on a frame that
+    // didn't do any data loading on the past transaction. Make sure to clear these out.
+    m_previousItem = 0;
+}
+
+void HistoryController::setCurrentItem(HistoryItem* item)
+{
+    m_currentItem = item;
+}
+
+void HistoryController::setCurrentItemTitle(const String& title)
+{
+    if (m_currentItem)
+        m_currentItem->setTitle(title);
+}
+
+void HistoryController::setProvisionalItem(HistoryItem* item)
+{
+    m_provisionalItem = item;
+}
+
+PassRefPtr<HistoryItem> HistoryController::createItem(bool useOriginal)
+{
+    DocumentLoader* docLoader = m_frame->loader()->documentLoader();
+    
+    KURL unreachableURL = docLoader ? docLoader->unreachableURL() : KURL();
+    
+    KURL url;
+    KURL originalURL;
+
+    if (!unreachableURL.isEmpty()) {
+        url = unreachableURL;
+        originalURL = unreachableURL;
+    } else {
+        originalURL = docLoader ? docLoader->originalURL() : KURL();
+        if (useOriginal)
+            url = originalURL;
+        else if (docLoader)
+            url = docLoader->requestURL();
+    }
+
+    LOG(History, "WebCoreHistory: Creating item for %s", url.string().ascii().data());
+    
+    // Frames that have never successfully loaded any content
+    // may have no URL at all. Currently our history code can't
+    // deal with such things, so we nip that in the bud here.
+    // Later we may want to learn to live with nil for URL.
+    // See bug 3368236 and related bugs for more information.
+    if (url.isEmpty()) 
+        url = blankURL();
+    if (originalURL.isEmpty())
+        originalURL = blankURL();
+    
+    Frame* parentFrame = m_frame->tree()->parent();
+    String parent = parentFrame ? parentFrame->tree()->name() : "";
+    String title = docLoader ? docLoader->title() : "";
+
+    RefPtr<HistoryItem> item = HistoryItem::create(url, m_frame->tree()->name(), parent, title);
+    item->setOriginalURLString(originalURL.string());
+
+    if (!unreachableURL.isEmpty() || !docLoader || docLoader->response().httpStatusCode() >= 400)
+        item->setLastVisitWasFailure(true);
+
+    // Save form state if this is a POST
+    if (docLoader) {
+        if (useOriginal)
+            item->setFormInfoFromRequest(docLoader->originalRequest());
+        else
+            item->setFormInfoFromRequest(docLoader->request());
+    }
+    
+    // Set the item for which we will save document state
+    m_previousItem = m_currentItem;
+    m_currentItem = item;
+    
+    return item.release();
+}
+
+PassRefPtr<HistoryItem> HistoryController::createItemTree(Frame* targetFrame, bool clipAtTarget)
+{
+    RefPtr<HistoryItem> bfItem = createItem(m_frame->tree()->parent() ? true : false);
+    if (m_previousItem)
+        saveScrollPositionAndViewStateToItem(m_previousItem.get());
+    if (!(clipAtTarget && m_frame == targetFrame)) {
+        // save frame state for items that aren't loading (khtml doesn't save those)
+        saveDocumentState();
+        for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+            FrameLoader* childLoader = child->loader();
+            bool hasChildLoaded = childLoader->frameHasLoaded();
+
+            // If the child is a frame corresponding to an <object> element that never loaded,
+            // we don't want to create a history item, because that causes fallback content
+            // to be ignored on reload.
+            
+            if (!(!hasChildLoaded && childLoader->isHostedByObjectElement()))
+                bfItem->addChildItem(childLoader->history()->createItemTree(targetFrame, clipAtTarget));
+        }
+    }
+    if (m_frame == targetFrame)
+        bfItem->setIsTargetItem(true);
+    return bfItem;
+}
+
+// The general idea here is to traverse the frame tree and the item tree in parallel,
+// tracking whether each frame already has the content the item requests.  If there is
+// a match (by URL), we just restore scroll position and recurse.  Otherwise we must
+// reload that frame, and all its kids.
+void HistoryController::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, FrameLoadType type)
+{
+    ASSERT(item);
+    ASSERT(fromItem);
+
+    KURL itemURL = item->url();
+    KURL currentURL;
+    if (m_frame->loader()->documentLoader())
+        currentURL = m_frame->loader()->documentLoader()->url();
+
+    // Always reload the target frame of the item we're going to.  This ensures that we will
+    // do -some- load for the transition, which means a proper notification will be posted
+    // to the app.
+    // The exact URL has to match, including fragment.  We want to go through the _load
+    // method, even if to do a within-page navigation.
+    // The current frame tree and the frame tree snapshot in the item have to match.
+    if (!item->isTargetItem() &&
+        itemURL == currentURL &&
+        ((m_frame->tree()->name().isEmpty() && item->target().isEmpty()) || m_frame->tree()->name() == item->target()) &&
+        childFramesMatchItem(item))
+    {
+        // This content is good, so leave it alone and look for children that need reloading
+        // Save form state (works from currentItem, since prevItem is nil)
+        ASSERT(!m_previousItem);
+        saveDocumentState();
+        saveScrollPositionAndViewStateToItem(m_currentItem.get());
+
+        if (FrameView* view = m_frame->view())
+            view->setWasScrolledByUser(false);
+
+        m_currentItem = item;
+                
+        // Restore form state (works from currentItem)
+        restoreDocumentState();
+        
+        // Restore the scroll position (we choose to do this rather than going back to the anchor point)
+        restoreScrollPositionAndViewState();
+        
+        const HistoryItemVector& childItems = item->children();
+        
+        int size = childItems.size();
+        for (int i = 0; i < size; ++i) {
+            String childFrameName = childItems[i]->target();
+            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
+            ASSERT(fromChildItem || fromItem->isTargetItem());
+            Frame* childFrame = m_frame->tree()->child(childFrameName);
+            ASSERT(childFrame);
+            childFrame->loader()->history()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
+        }
+    } else {
+        m_frame->loader()->loadItem(item, type);
+    }
+}
+
+// helper method that determines whether the subframes described by the item's subitems
+// match our own current frameset
+bool HistoryController::childFramesMatchItem(HistoryItem* item) const
+{
+    const HistoryItemVector& childItems = item->children();
+    if (childItems.size() != m_frame->tree()->childCount())
+        return false;
+    
+    unsigned size = childItems.size();
+    for (unsigned i = 0; i < size; ++i) {
+        if (!m_frame->tree()->child(childItems[i]->target()))
+            return false;
+    }
+    
+    // Found matches for all item targets
+    return true;
+}
+
+void HistoryController::updateBackForwardListClippedAtTarget(bool doClip)
+{
+    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
+    // The item that was the target of the user's navigation is designated as the "targetItem".  
+    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
+    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    if (m_frame->loader()->documentLoader()->urlForHistory().isEmpty())
+        return;
+
+    Frame* mainFrame = page->mainFrame();
+    ASSERT(mainFrame);
+    FrameLoader* frameLoader = mainFrame->loader();
+
+    frameLoader->checkDidPerformFirstNavigation();
+
+    RefPtr<HistoryItem> item = frameLoader->history()->createItemTree(m_frame, doClip);
+    LOG(BackForward, "WebCoreBackForward - Adding backforward item %p for frame %s", item.get(), m_frame->loader()->documentLoader()->url().string().ascii().data());
+    page->backForwardList()->addItem(item);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/HistoryController.h b/src/3rdparty/webkit/WebCore/loader/HistoryController.h
new file mode 100644
index 0000000..4ecae69
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/HistoryController.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HistoryController_h
+#define HistoryController_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class HistoryItem;
+
+class HistoryController : public Noncopyable {
+public:
+    HistoryController(Frame*);
+    ~HistoryController();
+
+    void saveScrollPositionAndViewStateToItem(HistoryItem*);
+    void restoreScrollPositionAndViewState();
+
+    void updateBackForwardListForFragmentScroll();
+
+    void saveDocumentState();
+    void saveDocumentAndScrollState();
+    void restoreDocumentState();
+
+    void invalidateCurrentItemCachedPage();
+
+    void goToItem(HistoryItem*, FrameLoadType);
+    bool urlsMatchItem(HistoryItem*) const;
+
+    void updateForBackForwardNavigation();
+    void updateForReload();
+    void updateForStandardLoad();
+    void updateForRedirectWithLockedBackForwardList();
+    void updateForClientRedirect();
+    void updateForCommit();
+    void updateForAnchorScroll();
+    void updateForFrameLoadCompleted();
+
+    HistoryItem* currentItem() const { return m_currentItem.get(); }
+    void setCurrentItem(HistoryItem*);
+    void setCurrentItemTitle(const String&);
+
+    HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
+    void setProvisionalItem(HistoryItem*);
+
+private:
+    PassRefPtr<HistoryItem> createItem(bool useOriginal);
+    PassRefPtr<HistoryItem> createItemTree(Frame* targetFrame, bool clipAtTarget);
+
+    void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
+    bool childFramesMatchItem(HistoryItem*) const;
+    void updateBackForwardListClippedAtTarget(bool doClip);
+
+    Frame* m_frame;
+
+    RefPtr<HistoryItem> m_currentItem;
+    RefPtr<HistoryItem> m_previousItem;
+    RefPtr<HistoryItem> m_provisionalItem;
+};
+
+} // namespace WebCore
+
+#endif // HistoryController_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
index b183a66..cdc31bc 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
@@ -31,34 +31,40 @@
 
 namespace WebCore {
 
-class ImageLoadEventSender {
+class ImageEventSender {
 public:
-    ImageLoadEventSender();
+    ImageEventSender(const AtomicString& eventType);
 
-    void dispatchLoadEventSoon(ImageLoader*);
-    void cancelLoadEvent(ImageLoader*);
+    void dispatchEventSoon(ImageLoader*);
+    void cancelEvent(ImageLoader*);
 
-    void dispatchPendingLoadEvents();
+    void dispatchPendingEvents();
 
 private:
-    ~ImageLoadEventSender();
+    void timerFired(Timer<ImageEventSender>*);
 
-    void timerFired(Timer<ImageLoadEventSender>*);
-
-    Timer<ImageLoadEventSender> m_timer;
+    AtomicString m_eventType;
+    Timer<ImageEventSender> m_timer;
     Vector<ImageLoader*> m_dispatchSoonList;
     Vector<ImageLoader*> m_dispatchingList;
 };
 
-static ImageLoadEventSender& loadEventSender()
+static ImageEventSender& beforeLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().beforeloadEvent));
+    return sender;
+}
+
+static ImageEventSender& loadEventSender()
 {
-    DEFINE_STATIC_LOCAL(ImageLoadEventSender, sender, ());
+    DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().loadEvent));
     return sender;
 }
 
 ImageLoader::ImageLoader(Element* element)
     : m_element(element)
     , m_image(0)
+    , m_firedBeforeLoad(true)
     , m_firedLoad(true)
     , m_imageComplete(true)
     , m_loadManually(false)
@@ -69,7 +75,10 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
-    loadEventSender().cancelLoadEvent(this);
+    if (!m_firedBeforeLoad)
+        beforeLoadEventSender().cancelEvent(this);
+    if (!m_firedLoad)
+        loadEventSender().cancelEvent(this);
 }
 
 void ImageLoader::setImage(CachedImage* newImage)
@@ -78,6 +87,7 @@ void ImageLoader::setImage(CachedImage* newImage)
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
         setLoadingImage(newImage);
+        m_firedBeforeLoad = true;
         m_firedLoad = true;
         m_imageComplete = true;
         if (newImage)
@@ -89,16 +99,16 @@ void ImageLoader::setImage(CachedImage* newImage)
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
-
         toRenderImage(renderer)->resetAnimation();
     }
 }
 
 void ImageLoader::setLoadingImage(CachedImage* loadingImage)
 {
-    m_firedLoad = false;
-    m_imageComplete = false;
     m_image = loadingImage;
+    m_firedBeforeLoad = !loadingImage;
+    m_firedLoad = !loadingImage;
+    m_imageComplete = !loadingImage;
 }
 
 void ImageLoader::updateFromElement()
@@ -137,8 +147,13 @@ void ImageLoader::updateFromElement()
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
         setLoadingImage(newImage);
-        if (newImage)
+        if (newImage) {
             newImage->addClient(this);
+            if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+                dispatchPendingBeforeLoadEvent();
+            else
+                beforeLoadEventSender().dispatchEventSoon(this);
+        }
         if (oldImage)
             oldImage->removeClient(this);
     }
@@ -146,7 +161,6 @@ void ImageLoader::updateFromElement()
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
-
         toRenderImage(renderer)->resetAnimation();
     }
 }
@@ -161,16 +175,48 @@ void ImageLoader::updateFromElementIgnoringPreviousError()
 void ImageLoader::notifyFinished(CachedResource*)
 {
     ASSERT(m_failedLoadURL.isEmpty());
+
     m_imageComplete = true;
+    if (haveFiredBeforeLoadEvent())
+        updateRenderer();
 
-    loadEventSender().dispatchLoadEventSoon(this);
+    loadEventSender().dispatchEventSoon(this);
+}
 
+void ImageLoader::updateRenderer()
+{
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
+        RenderImage* imageRenderer = toRenderImage(renderer);
+        
+        // Only update the renderer if it doesn't have an image or if what we have
+        // is a complete image.  This prevents flickering in the case where a dynamic
+        // change is happening between two images.
+        CachedImage* cachedImage = imageRenderer->cachedImage();
+        if (m_image != cachedImage && (m_imageComplete || !imageRenderer->cachedImage()))
+            imageRenderer->setCachedImage(m_image.get());
+    }
+}
 
-        toRenderImage(renderer)->setCachedImage(m_image.get());
+void ImageLoader::dispatchPendingBeforeLoadEvent()
+{
+    if (m_firedBeforeLoad)
+        return;
+    if (!m_image)
+        return;
+    if (!m_element->document()->attached())
+        return;
+    m_firedBeforeLoad = true;
+    if (m_element->dispatchBeforeLoadEvent(m_image->url())) {
+        updateRenderer();
+        return;
+    }
+    if (m_image) {
+        m_image->removeClient(this);
+        m_image = 0;
     }
+    loadEventSender().cancelEvent(this);
 }
 
 void ImageLoader::dispatchPendingLoadEvent()
@@ -185,24 +231,26 @@ void ImageLoader::dispatchPendingLoadEvent()
     dispatchLoadEvent();
 }
 
-void ImageLoader::dispatchPendingLoadEvents()
+void ImageLoader::dispatchPendingEvents()
 {
-    loadEventSender().dispatchPendingLoadEvents();
+    beforeLoadEventSender().dispatchPendingEvents();
+    loadEventSender().dispatchPendingEvents();
 }
 
-ImageLoadEventSender::ImageLoadEventSender()
-    : m_timer(this, &ImageLoadEventSender::timerFired)
+ImageEventSender::ImageEventSender(const AtomicString& eventType)
+    : m_eventType(eventType)
+    , m_timer(this, &ImageEventSender::timerFired)
 {
 }
 
-void ImageLoadEventSender::dispatchLoadEventSoon(ImageLoader* loader)
+void ImageEventSender::dispatchEventSoon(ImageLoader* loader)
 {
     m_dispatchSoonList.append(loader);
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
+void ImageEventSender::cancelEvent(ImageLoader* loader)
 {
     // Remove instances of this loader from both lists.
     // Use loops because we allow multiple instances to get into the lists.
@@ -220,7 +268,7 @@ void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
         m_timer.stop();
 }
 
-void ImageLoadEventSender::dispatchPendingLoadEvents()
+void ImageEventSender::dispatchPendingEvents()
 {
     // Need to avoid re-entering this function; if new dispatches are
     // scheduled before the parent finishes processing the list, they
@@ -233,15 +281,19 @@ void ImageLoadEventSender::dispatchPendingLoadEvents()
     m_dispatchingList.swap(m_dispatchSoonList);
     size_t size = m_dispatchingList.size();
     for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* loader = m_dispatchingList[i])
-            loader->dispatchPendingLoadEvent();
+        if (ImageLoader* loader = m_dispatchingList[i]) {
+            if (m_eventType == eventNames().beforeloadEvent)
+                loader->dispatchPendingBeforeLoadEvent();
+            else
+                loader->dispatchPendingLoadEvent();
+        }
     }
     m_dispatchingList.clear();
 }
 
-void ImageLoadEventSender::timerFired(Timer<ImageLoadEventSender>*)
+void ImageEventSender::timerFired(Timer<ImageEventSender>*)
 {
-    dispatchPendingLoadEvents();
+    dispatchPendingEvents();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
index 3496f75..7f42e33 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
@@ -53,9 +53,10 @@ public:
 
     void setLoadManually(bool loadManually) { m_loadManually = loadManually; }
 
+    bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
-    static void dispatchPendingLoadEvents();
+    static void dispatchPendingEvents();
 
 protected:
     virtual void notifyFinished(CachedResource*);
@@ -64,14 +65,18 @@ private:
     virtual void dispatchLoadEvent() = 0;
     virtual String sourceURI(const AtomicString&) const = 0;
 
-    friend class ImageLoadEventSender;
+    friend class ImageEventSender;
+    void dispatchPendingBeforeLoadEvent();
     void dispatchPendingLoadEvent();
 
     void setLoadingImage(CachedImage*);
 
+    void updateRenderer();
+
     Element* m_element;
     CachedResourceHandle<CachedImage> m_image;
     AtomicString m_failedLoadURL;
+    bool m_firedBeforeLoad : 1;
     bool m_firedLoad : 1;
     bool m_imageComplete : 1;
     bool m_loadManually : 1;
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
index a3e90fd..c37daef 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
@@ -77,7 +77,7 @@ void MainResourceLoader::receivedError(const ResourceError& error)
 
     if (!cancelled()) {
         ASSERT(!reachedTerminalState());
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
         
         releaseResources();
     }
@@ -93,7 +93,7 @@ void MainResourceLoader::didCancel(const ResourceError& error)
     RefPtr<MainResourceLoader> protect(this);
 
     if (m_waitingForContentPolicy) {
-        frameLoader()->cancelContentPolicyCheck();
+        frameLoader()->policyChecker()->cancelCheck();
         ASSERT(m_waitingForContentPolicy);
         m_waitingForContentPolicy = false;
         deref(); // balances ref in didReceiveResponse
@@ -182,7 +182,7 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // synchronously for these redirect cases.
     if (!redirectResponse.isNull()) {
         ref(); // balanced by deref in continueAfterNavigationPolicy
-        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+        frameLoader()->policyChecker()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
     }
 }
 
@@ -205,7 +205,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
         // Prevent remote web archives from loading because they can claim to be from any domain and thus avoid cross-domain security checks (4120255).
         bool isRemoteWebArchive = equalIgnoringCase("application/x-webarchive", mimeType) && !m_substituteData.isValid() && !url.isLocalFile();
         if (!frameLoader()->canShowMIMEType(mimeType) || isRemoteWebArchive) {
-            frameLoader()->cannotShowMIMEType(r);
+            frameLoader()->policyChecker()->cannotShowMIMEType(r);
             // Check reachedTerminalState since the load may have already been cancelled inside of _handleUnimplementablePolicyWithErrorCode::.
             if (!reachedTerminalState())
                 stopLoadingForPolicyChange();
@@ -320,7 +320,25 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(!m_waitingForContentPolicy);
     m_waitingForContentPolicy = true;
     ref(); // balanced by deref in continueAfterContentPolicy and didCancel
-    frameLoader()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
+
+    ASSERT(frameLoader()->activeDocumentLoader());
+
+    // Always show content with valid substitute data.
+    if (frameLoader()->activeDocumentLoader()->substituteData().isValid()) {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+
+#if ENABLE(FTPDIR)
+    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
+    Settings* settings = m_frame->settings();
+    if (settings && settings->forceFTPDirectoryListings() && m_response.mimeType() == "application/x-ftp-directory") {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+#endif
+
+    frameLoader()->policyChecker()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
 }
 
 void MainResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyCallback.cpp b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.cpp
new file mode 100644
index 0000000..14799cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyCallback.h"
+
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyCallback::PolicyCallback()
+    : m_navigationFunction(0)
+    , m_newWindowFunction(0)
+    , m_contentFunction(0)
+{
+}
+
+PolicyCallback::~PolicyCallback()
+{
+}
+
+void PolicyCallback::clear()
+{
+    clearRequest();
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    NavigationPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = String();
+
+    m_navigationFunction = function;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = frameName;
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = function;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(ContentPolicyDecisionFunction function, void* argument)
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = function;
+    m_argument = argument;
+}
+
+void PolicyCallback::call(bool shouldContinue)
+{
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
+    ASSERT(!m_contentFunction);
+}
+
+void PolicyCallback::call(PolicyAction action)
+{
+    ASSERT(!m_navigationFunction);
+    ASSERT(!m_newWindowFunction);
+    ASSERT(m_contentFunction);
+    m_contentFunction(m_argument, action);
+}
+
+void PolicyCallback::clearRequest()
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+}
+
+void PolicyCallback::cancel()
+{
+    clearRequest();
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
+    if (m_contentFunction)
+        m_contentFunction(m_argument, PolicyIgnore);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyCallback.h b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.h
new file mode 100644
index 0000000..757fff8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyCallback.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyCallback_h
+#define PolicyCallback_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "ResourceRequest.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class FormState;
+
+typedef void (*NavigationPolicyDecisionFunction)(void* argument,
+    const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
+    const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
+
+class PolicyCallback {
+public:
+    PolicyCallback();
+    ~PolicyCallback();
+
+    void clear();
+    void set(const ResourceRequest&, PassRefPtr<FormState>,
+        NavigationPolicyDecisionFunction, void* argument);
+    void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
+        NewWindowPolicyDecisionFunction, void* argument);
+    void set(ContentPolicyDecisionFunction, void* argument);
+
+    const ResourceRequest& request() const { return m_request; }
+    void clearRequest();
+
+    void call(bool shouldContinue);
+    void call(PolicyAction);
+    void cancel();
+
+private:
+    ResourceRequest m_request;
+    RefPtr<FormState> m_formState;
+    String m_frameName;
+
+    NavigationPolicyDecisionFunction m_navigationFunction;
+    NewWindowPolicyDecisionFunction m_newWindowFunction;
+    ContentPolicyDecisionFunction m_contentFunction;
+    void* m_argument;
+};
+
+} // namespace WebCore
+
+#endif // PolicyCallback_h
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyChecker.cpp b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.cpp
new file mode 100644
index 0000000..196ab4f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyChecker.h"
+
+#include "DocumentLoader.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyChecker::PolicyChecker(Frame* frame)
+    : m_frame(frame)
+    , m_delegateIsDecidingNavigationPolicy(false)
+    , m_delegateIsHandlingUnimplementablePolicy(false)
+    , m_loadType(FrameLoadTypeStandard)
+{
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
+{
+    checkNavigationPolicy(newRequest, m_frame->loader()->activeDocumentLoader(), 0, function, argument);
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
+    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
+{
+    NavigationAction action = loader->triggeringAction();
+    if (action.isEmpty()) {
+        action = NavigationAction(request.url(), NavigationTypeOther);
+        loader->setTriggeringAction(action);
+    }
+
+    // Don't ask more than once for the same request or if we are loading an empty URL.
+    // This avoids confusion on the part of the client.
+    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
+        function(argument, request, 0, true);
+        loader->setLastCheckedRequest(request);
+        return;
+    }
+    
+    // We are always willing to show alternate content for unreachable URLs;
+    // treat it like a reload so it maintains the right state for b/f list.
+    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
+        if (isBackForwardLoadType(m_loadType))
+            m_loadType = FrameLoadTypeReload;
+        function(argument, request, 0, true);
+        return;
+    }
+    
+    loader->setLastCheckedRequest(request);
+
+    m_callback.set(request, formState.get(), function, argument);
+
+    m_delegateIsDecidingNavigationPolicy = true;
+    m_frame->loader()->client()->dispatchDecidePolicyForNavigationAction(&PolicyChecker::continueAfterNavigationPolicy,
+        action, request, formState);
+    m_delegateIsDecidingNavigationPolicy = false;
+}
+
+void PolicyChecker::checkNewWindowPolicy(const NavigationAction& action, NewWindowPolicyDecisionFunction function,
+    const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, void* argument)
+{
+    m_callback.set(request, formState, frameName, function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForNewWindowAction(&PolicyChecker::continueAfterNewWindowPolicy,
+        action, request, formState, frameName);
+}
+
+void PolicyChecker::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+{
+    m_callback.set(function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForMIMEType(&PolicyChecker::continueAfterContentPolicy,
+        MIMEType, m_frame->loader()->activeDocumentLoader()->request());
+}
+
+void PolicyChecker::cancelCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    m_callback.clear();
+}
+
+void PolicyChecker::stopCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.cancel();
+}
+
+void PolicyChecker::cannotShowMIMEType(const ResourceResponse& response)
+{
+    handleUnimplementablePolicy(m_frame->loader()->client()->cannotShowMIMETypeError(response));
+}
+
+void PolicyChecker::continueLoadAfterWillSubmitForm(PolicyAction)
+{
+    // See header file for an explaination of why this function
+    // isn't like the others.
+    m_frame->loader()->continueLoadAfterWillSubmitForm();
+}
+
+void PolicyChecker::continueAfterNavigationPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    bool shouldContinue = policy == PolicyUse;
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse: {
+            ResourceRequest request(callback.request());
+
+            if (!m_frame->loader()->client()->canHandleRequest(request)) {
+                handleUnimplementablePolicy(m_frame->loader()->cannotShowURLError(callback.request()));
+                callback.clearRequest();
+                shouldContinue = false;
+            }
+            break;
+        }
+    }
+
+    callback.call(shouldContinue);
+}
+
+void PolicyChecker::continueAfterNewWindowPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse:
+            break;
+    }
+
+    callback.call(policy == PolicyUse);
+}
+
+void PolicyChecker::continueAfterContentPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.call(policy);
+}
+
+void PolicyChecker::handleUnimplementablePolicy(const ResourceError& error)
+{
+    m_delegateIsHandlingUnimplementablePolicy = true;
+    m_frame->loader()->client()->dispatchUnableToImplementPolicy(error);
+    m_delegateIsHandlingUnimplementablePolicy = false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/PolicyChecker.h b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.h
new file mode 100644
index 0000000..541729c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/PolicyChecker.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyChecker_h
+#define PolicyChecker_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "PolicyCallback.h"
+#include "ResourceRequest.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class DocumentLoader;
+class FormState;
+class Frame;
+class NavigationAction;
+class ResourceError;
+class ResourceResponse;
+
+class PolicyChecker : public Noncopyable {
+public:
+    PolicyChecker(Frame*);
+
+    void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+    void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
+    void checkNewWindowPolicy(const NavigationAction&, NewWindowPolicyDecisionFunction, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, void* argument);
+    void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
+
+    // FIXME: These are different.  They could use better names.
+    void cancelCheck();
+    void stopCheck();
+
+    void cannotShowMIMEType(const ResourceResponse&);
+
+    FrameLoadType loadType() const { return m_loadType; }
+    void setLoadType(FrameLoadType loadType) { m_loadType = loadType; }
+
+    bool delegateIsDecidingNavigationPolicy() const { return m_delegateIsDecidingNavigationPolicy; }
+    bool delegateIsHandlingUnimplementablePolicy() const { return m_delegateIsHandlingUnimplementablePolicy; }
+
+    // FIXME: This function is a cheat.  Basically, this is just an asynchronouc callback
+    // from the FrameLoaderClient, but this callback uses the policy types and so has to
+    // live on this object.  In the long term, we should create a type for non-policy
+    // callbacks from the FrameLoaderClient and remove this vestige.  I just don't have
+    // the heart to hack on all the platforms to make that happen right now.
+    void continueLoadAfterWillSubmitForm(PolicyAction);
+
+private:
+    void continueAfterNavigationPolicy(PolicyAction);
+    void continueAfterNewWindowPolicy(PolicyAction);
+    void continueAfterContentPolicy(PolicyAction);
+
+    void handleUnimplementablePolicy(const ResourceError&);
+
+    Frame* m_frame;
+
+    bool m_delegateIsDecidingNavigationPolicy;
+    bool m_delegateIsHandlingUnimplementablePolicy;
+
+    // This identifies the type of navigation action which prompted this load. Note 
+    // that WebKit conveys this value as the WebActionNavigationTypeKey value
+    // on navigation action delegate callbacks.
+    FrameLoadType m_loadType;
+    PolicyCallback m_callback;
+};
+
+} // namespace WebCore
+
+#endif // PolicyChecker_h
diff --git a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
new file mode 100644
index 0000000..f015c12
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.cpp
@@ -0,0 +1,374 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RedirectScheduler.h"
+
+#include "DocumentLoader.h"
+#include "Event.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+struct ScheduledRedirection {
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
+
+    const Type type;
+    const double delay;
+    const String url;
+    const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
+    const int historySteps;
+    const bool lockHistory;
+    const bool lockBackForwardList;
+    const bool wasUserGesture;
+    const bool wasRefresh;
+    const bool wasDuringLoad;
+    bool toldClient;
+
+    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
+        : type(redirection)
+        , delay(delay)
+        , url(url)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
+        , delay(0)
+        , url(url)
+        , referrer(referrer)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    explicit ScheduledRedirection(int historyNavigationSteps)
+        : type(historyNavigation)
+        , delay(0)
+        , historySteps(historyNavigationSteps)
+        , lockHistory(false)
+        , lockBackForwardList(false)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+    }
+
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+
+RedirectScheduler::RedirectScheduler(Frame* frame)
+    : m_frame(frame)
+    , m_timer(this, &RedirectScheduler::timerFired)
+{
+}
+
+RedirectScheduler::~RedirectScheduler()
+{
+}
+
+bool RedirectScheduler::redirectScheduledDuringLoad()
+{
+    return m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad;
+}
+
+void RedirectScheduler::clear()
+{
+    m_timer.stop();
+    m_scheduledRedirection.clear();
+}
+
+void RedirectScheduler::scheduleRedirect(double delay, const String& url)
+{
+    if (delay < 0 || delay > INT_MAX / 1000)
+        return;
+        
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    // We want a new history item if the refresh timeout is > 1 second.
+    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
+        schedule(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
+}
+
+bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
+{
+    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
+    // The definition of "during load" is any time before all handlers for the load event have been run.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    
+    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
+        Document* document = ancestor->document();
+        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+            return true;
+    }
+    return false;
+}
+
+void RedirectScheduler::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
+
+    FrameLoader* loader = m_frame->loader();
+    
+    // If the URL we're going to navigate to is the same as the current one, except for the
+    // fragment part, we don't need to schedule the location change.
+    KURL parsedURL(ParsedURLString, url);
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(loader->url(), parsedURL)) {
+        loader->changeLocation(loader->completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
+        return;
+    }
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !loader->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
+
+void RedirectScheduler::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
+
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_frame->loader()->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
+}
+
+void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+    
+    const KURL& url = m_frame->loader()->url();
+
+    if (url.isEmpty())
+        return;
+
+    schedule(new ScheduledRedirection(url.string(), m_frame->loader()->outgoingReferrer(), true, true, wasUserGesture, true, false));
+}
+
+bool RedirectScheduler::locationChangePending()
+{
+    if (!m_scheduledRedirection)
+        return false;
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::redirection:
+            return false;
+        case ScheduledRedirection::historyNavigation:
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::formSubmission:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void RedirectScheduler::scheduleHistoryNavigation(int steps)
+{
+    if (!m_frame->page())
+        return;
+
+    schedule(new ScheduledRedirection(steps));
+}
+
+void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
+{
+    ASSERT(m_frame->page());
+
+    if (m_frame->page()->defersLoading())
+        return;
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    FrameLoader* loader = m_frame->loader();
+
+    switch (redirection->type) {
+        case ScheduledRedirection::redirection:
+        case ScheduledRedirection::locationChange:
+            loader->changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
+                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
+            return;
+        case ScheduledRedirection::historyNavigation:
+            if (redirection->historySteps == 0) {
+                // Special case for go(0) from a frame -> reload only the frame
+                loader->urlSelected(loader->url(), "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, SendReferrer);
+                return;
+            }
+            // go(i!=0) from a frame navigates into the history of the frame only,
+            // in both IE and NS (but not in Mozilla). We can't easily do that.
+            if (m_frame->page()->canGoBackOrForward(redirection->historySteps))
+                m_frame->page()->goBackOrForward(redirection->historySteps);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loader->loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState, SendReferrer);
+            return;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::schedule(PassOwnPtr<ScheduledRedirection> redirection)
+{
+    ASSERT(m_frame->page());
+    FrameLoader* loader = m_frame->loader();
+
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (DocumentLoader* provisionalDocumentLoader = loader->provisionalDocumentLoader())
+            provisionalDocumentLoader->stopLoading();
+        loader->stopLoading(UnloadEventPolicyUnloadAndPageHide);   
+    }
+
+    cancel();
+    m_scheduledRedirection = redirection;
+    if (!loader->isComplete() && m_scheduledRedirection->type != ScheduledRedirection::redirection)
+        loader->completed();
+    startTimer();
+}
+
+void RedirectScheduler::startTimer()
+{
+    if (!m_scheduledRedirection)
+        return;
+
+    ASSERT(m_frame->page());
+    
+    FrameLoader* loader = m_frame->loader();
+
+    if (m_timer.isActive())
+        return;
+
+    if (m_scheduledRedirection->type == ScheduledRedirection::redirection && !loader->allAncestorsAreComplete())
+        return;
+
+    m_timer.startOneShot(m_scheduledRedirection->delay);
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::redirection:
+            if (m_scheduledRedirection->toldClient)
+                return;
+            m_scheduledRedirection->toldClient = true;
+            loader->clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
+                m_scheduledRedirection->delay,
+                currentTime() + m_timer.nextFireInterval(),
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
+            return;
+        case ScheduledRedirection::historyNavigation:
+            // Don't report history navigations.
+            return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::cancel(bool newLoadInProgress)
+{
+    m_timer.stop();
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    if (redirection && redirection->toldClient)
+        m_frame->loader()->clientRedirectCancelledOrFinished(newLoadInProgress);
+}
+
+} // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.h b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.h
new file mode 100644
index 0000000..005a173
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/RedirectScheduler.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RedirectScheduler_h
+#define RedirectScheduler_h
+
+#include "Event.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class FormState;
+class Frame;
+class String;
+
+struct FrameLoadRequest;
+struct ScheduledRedirection;
+
+class RedirectScheduler : public Noncopyable {
+public:
+    RedirectScheduler(Frame*);
+    ~RedirectScheduler();
+
+    bool redirectScheduledDuringLoad();
+    bool locationChangePending();
+
+    void scheduleRedirect(double delay, const String& url);
+    void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
+    void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void scheduleRefresh(bool userGesture = false);
+    void scheduleHistoryNavigation(int steps);
+
+    void startTimer();
+
+    void cancel(bool newLoadInProgress = false);
+    void clear();
+
+private:
+    void timerFired(Timer<RedirectScheduler>*);
+    void schedule(PassOwnPtr<ScheduledRedirection>);
+
+    static bool mustLockBackForwardList(Frame* targetFrame);
+
+    Frame* m_frame;
+    Timer<RedirectScheduler> m_timer;
+    OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+};
+
+} // namespace WebCore
+
+#endif // FrameLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
new file mode 100644
index 0000000..4cddd01
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ResourceLoadNotifier.h"
+
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "InspectorController.h"
+#include "Page.h"
+#include "ProgressTracker.h"
+#include "ResourceLoader.h"
+
+namespace WebCore {
+
+ResourceLoadNotifier::ResourceLoadNotifier(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+void ResourceLoadNotifier::didReceiveAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
+{
+    m_frame->loader()->client()->dispatchDidReceiveAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
+}
+
+void ResourceLoadNotifier::didCancelAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
+{
+    m_frame->loader()->client()->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
+}
+
+void ResourceLoadNotifier::willSendRequest(ResourceLoader* loader, ResourceRequest& clientRequest, const ResourceResponse& redirectResponse)
+{
+    m_frame->loader()->applyUserAgent(clientRequest);
+
+    dispatchWillSendRequest(loader->documentLoader(), loader->identifier(), clientRequest, redirectResponse);
+}
+
+void ResourceLoadNotifier::didReceiveResponse(ResourceLoader* loader, const ResourceResponse& r)
+{
+    loader->documentLoader()->addResponse(r);
+
+    if (Page* page = m_frame->page())
+        page->progress()->incrementProgress(loader->identifier(), r);
+
+    dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
+}
+
+void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
+{
+    if (Page* page = m_frame->page())
+        page->progress()->incrementProgress(loader->identifier(), data, length);
+
+    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
+}
+
+void ResourceLoadNotifier::didFinishLoad(ResourceLoader* loader)
+{    
+    if (Page* page = m_frame->page())
+        page->progress()->completeProgress(loader->identifier());
+    dispatchDidFinishLoading(loader->documentLoader(), loader->identifier());
+}
+
+void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceError& error)
+{
+    if (Page* page = m_frame->page())
+        page->progress()->completeProgress(loader->identifier());
+
+    if (!error.isNull())
+        m_frame->loader()->client()->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
+}
+
+void ResourceLoadNotifier::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
+{
+    m_frame->loader()->client()->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+}
+
+void ResourceLoadNotifier::assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
+{
+    m_frame->loader()->client()->assignIdentifierToInitialRequest(identifier, loader, request);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    StringImpl* oldRequestURL = request.url().string().impl();
+    m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
+
+    m_frame->loader()->client()->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
+
+    // If the URL changed, then we want to put that new URL in the "did tell client" set too.
+    if (!request.isNull() && oldRequestURL != request.url().string().impl())
+        m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    m_frame->loader()->client()->dispatchDidReceiveResponse(loader, identifier, r);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didReceiveResponse(loader, identifier, r);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
+{
+    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, length);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
+{
+    m_frame->loader()->client()->dispatchDidFinishLoading(loader, identifier);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didFinishLoading(loader, identifier);
+#endif
+}
+
+void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
+{
+    if (!response.isNull())
+        dispatchDidReceiveResponse(loader, identifier, response);
+
+    if (length > 0)
+        dispatchDidReceiveContentLength(loader, identifier, length);
+
+    if (error.isNull())
+        dispatchDidFinishLoading(loader, identifier);
+    else
+        m_frame->loader()->client()->dispatchDidFailLoading(loader, identifier, error);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
new file mode 100644
index 0000000..b8f078a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoadNotifier.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ResourceLoadNotifier_h
+#define ResourceLoadNotifier_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class DocumentLoader;
+class Frame;
+class ResourceError;
+class ResourceLoader;
+class ResourceResponse;
+class ResourceRequest;
+class ScriptString;
+
+class ResourceLoadNotifier : public Noncopyable {
+public:
+    ResourceLoadNotifier(Frame*);
+
+    void didReceiveAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
+    void didCancelAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
+
+    void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
+    void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
+    void didFinishLoad(ResourceLoader*);
+    void didFailToLoad(ResourceLoader*, const ResourceError&);
+    void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+
+    void assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
+    void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
+    void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
+
+    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+
+private:
+    Frame* m_frame;
+};
+
+} // namespace WebCore
+
+#endif // ResourceLoadNotifier_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
index ee7dea9..9244cf0 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
@@ -197,18 +197,18 @@ void ResourceLoader::willSendRequest(ResourceRequest& request, const ResourceRes
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-        
+
     ASSERT(!m_reachedTerminalState);
 
     if (m_sendResourceLoadCallbacks) {
         if (!m_identifier) {
             m_identifier = m_frame->page()->progress()->createUniqueIdentifier();
-            frameLoader()->assignIdentifierToInitialRequest(m_identifier, request);
+            frameLoader()->notifier()->assignIdentifierToInitialRequest(m_identifier, documentLoader(), request);
         }
 
-        frameLoader()->willSendRequest(this, request, redirectResponse);
+        frameLoader()->notifier()->willSendRequest(this, request, redirectResponse);
     }
-    
+
     m_request = request;
 }
 
@@ -230,7 +230,7 @@ void ResourceLoader::didReceiveResponse(const ResourceResponse& r)
         data->removeGeneratedFilesIfNeeded();
         
     if (m_sendResourceLoadCallbacks)
-        frameLoader()->didReceiveResponse(this, m_response);
+        frameLoader()->notifier()->didReceiveResponse(this, m_response);
 }
 
 void ResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
@@ -250,7 +250,7 @@ void ResourceLoader::didReceiveData(const char* data, int length, long long leng
     // However, with today's computers and networking speeds, this won't happen in practice.
     // Could be an issue with a giant local file.
     if (m_sendResourceLoadCallbacks && m_frame)
-        frameLoader()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
+        frameLoader()->notifier()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
 }
 
 void ResourceLoader::willStopBufferingData(const char* data, int length)
@@ -284,7 +284,7 @@ void ResourceLoader::didFinishLoadingOnePart()
         return;
     m_calledDidFinishLoad = true;
     if (m_sendResourceLoadCallbacks)
-        frameLoader()->didFinishLoad(this);
+        frameLoader()->notifier()->didFinishLoad(this);
 }
 
 void ResourceLoader::didFail(const ResourceError& error)
@@ -301,7 +301,7 @@ void ResourceLoader::didFail(const ResourceError& error)
         data->removeGeneratedFilesIfNeeded();
 
     if (m_sendResourceLoadCallbacks && !m_calledDidFinishLoad)
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
 
     releaseResources();
 }
@@ -330,7 +330,7 @@ void ResourceLoader::didCancel(const ResourceError& error)
         m_handle = 0;
     }
     if (m_sendResourceLoadCallbacks && !m_calledDidFinishLoad)
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
 
     releaseResources();
 }
@@ -433,7 +433,7 @@ void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChall
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-    frameLoader()->didReceiveAuthenticationChallenge(this, challenge);
+    frameLoader()->notifier()->didReceiveAuthenticationChallenge(this, challenge);
 }
 
 void ResourceLoader::didCancelAuthenticationChallenge(const AuthenticationChallenge& challenge)
@@ -441,7 +441,7 @@ void ResourceLoader::didCancelAuthenticationChallenge(const AuthenticationChalle
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-    frameLoader()->didCancelAuthenticationChallenge(this, challenge);
+    frameLoader()->notifier()->didCancelAuthenticationChallenge(this, challenge);
 }
 
 void ResourceLoader::receivedCancellation(const AuthenticationChallenge&)
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
index 047cc6d..2ee4626 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include "SubresourceLoaderClient.h"
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -72,13 +73,13 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
     ResourceRequest newRequest = request;
 
     if (!skipCanLoadCheck
-            && FrameLoader::restrictAccessToLocal()
-            && !FrameLoader::canLoad(request.url(), String(), frame->document())) {
+            && SecurityOrigin::restrictAccessToLocal()
+            && !SecurityOrigin::canLoad(request.url(), String(), frame->document())) {
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
         return 0;
     }
     
-    if (FrameLoader::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
         newRequest.clearHTTPReferrer();
     else if (!request.httpReferrer())
         newRequest.setHTTPReferrer(fl->outgoingReferrer());
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
index 6819759..bd362f4 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -91,7 +91,7 @@ WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<Threadable
                                                            const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
-    , m_taskMode(taskMode.copy())
+    , m_taskMode(taskMode.crossThreadString())
 {
     ASSERT(m_workerClientWrapper.get());
     m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index ed27ba0..c66f36f 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -158,7 +158,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
             // Restart the current navigation from the top of the navigation algorithm, undoing any changes that were made
             // as part of the initial load.
             // The navigation will not result in the same resource being loaded, because "foreign" entries are never picked during navigation.
-            frame->loader()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
+            frame->redirectScheduler()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
         }
         
         return;
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
index b78291d..78ca0a5 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
@@ -128,7 +128,7 @@ bool IconDatabase::open(const String& databasePath)
         return false;
     }
 
-    m_databaseDirectory = databasePath.copy();
+    m_databaseDirectory = databasePath.crossThreadString();
 
     // Formulate the full path for the database file
     m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, defaultDatabaseFilename());
@@ -227,7 +227,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord) {
-        pageURLCopy = pageURLOriginal.copy();
+        pageURLCopy = pageURLOriginal.crossThreadString();
         pageRecord = getOrCreatePageURLRecord(pageURLCopy);
     }
     
@@ -263,7 +263,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     // mark it to be read by the background thread
     if (iconRecord->imageDataStatus() == ImageDataStatusUnknown) {
         if (pageURLCopy.isNull())
-            pageURLCopy = pageURLOriginal.copy();
+            pageURLCopy = pageURLOriginal.crossThreadString();
     
         MutexLocker locker(m_pendingReadingLock);
         m_pageURLsInterestedInIcons.add(pageURLCopy);
@@ -312,7 +312,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord)
-        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.copy());
+        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.crossThreadString());
     
     // If pageRecord is NULL, one of two things is true -
     // 1 - The initial url import is incomplete and this pageURL has already been marked to be notified once it is complete if an iconURL exists
@@ -321,7 +321,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
         return String();
     
     // Possible the pageRecord is around because it's a retained pageURL with no iconURL, so we have to check
-    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().copy() : String();
+    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().threadsafeCopy() : String();
 }
 
 #ifdef CAN_THEME_URL_ICON
@@ -405,7 +405,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     String pageURL;
     
     if (!record) {
-        pageURL = pageURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
 
         record = new PageURLRecord(pageURL);
         m_pageURLToRecordMap.set(pageURL, record);
@@ -413,7 +413,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     
     if (!record->retain()) {
         if (pageURL.isNull())
-            pageURL = pageURLOriginal.copy();
+            pageURL = pageURLOriginal.crossThreadString();
 
         // This page just had its retain count bumped from 0 to 1 - Record that fact
         m_retainedPageURLs.add(pageURL);
@@ -488,7 +488,7 @@ void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
     // Mark stuff for deletion from the database only if we're not in private browsing
     if (!m_privateBrowsingEnabled) {
         MutexLocker locker(m_pendingSyncLock);
-        m_pageURLsPendingSync.set(pageURLOriginal.copy(), pageRecord->snapshot(true));
+        m_pageURLsPendingSync.set(pageURLOriginal.crossThreadString(), pageRecord->snapshot(true));
     
         // If this page is the last page to refer to a particular IconRecord, that IconRecord needs to
         // be marked for deletion
@@ -512,7 +512,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
         return;
     
     RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : 0;
-    String iconURL = iconURLOriginal.copy();
+    String iconURL = iconURLOriginal.crossThreadString();
     
     Vector<String> pageURLs;
     {
@@ -589,8 +589,8 @@ void IconDatabase::setIconURLForPageURL(const String& iconURLOriginal, const Str
         if (pageRecord && pageRecord->iconRecord() && pageRecord->iconRecord()->iconURL() == iconURLOriginal)
             return;
             
-        pageURL = pageURLOriginal.copy();
-        iconURL = iconURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
+        iconURL = iconURLOriginal.crossThreadString();
 
         if (!pageRecord) {
             pageRecord = new PageURLRecord(pageURL);
@@ -847,13 +847,13 @@ bool IconDatabase::isOpen() const
 String IconDatabase::databasePath() const
 {
     MutexLocker locker(m_syncLock);
-    return m_completeDatabasePath.copy();
+    return m_completeDatabasePath.threadsafeCopy();
 }
 
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("WebpageIcons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 // Unlike getOrCreatePageURLRecord(), getOrCreateIconRecord() does not mark the icon as "interested in import"
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
index 03a7964..7b7cc9f 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
@@ -53,7 +53,7 @@ const int updateTimerDelay = 5;
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 IconDatabase* iconDatabase()
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 2d11275..5231603 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -203,6 +203,10 @@ namespace WebCore {
         virtual void scheduleCompositingLayerSync() = 0;
 #endif
 
+        virtual bool supportsFullscreenForNode(const Node*) { return false; }
+        virtual void enterFullscreenForNode(Node*) { }
+        virtual void exitFullscreenForNode(Node*) { }
+        
 #if PLATFORM(MAC)
         virtual KeyboardUIMode keyboardUIMode() { return KeyboardAccessDefault; }
 
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
index a3a86a5..7d773ca 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
@@ -166,10 +166,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->editor()->copy();
         break;
     case ContextMenuItemTagGoBack:
-        frame->loader()->goBackOrForward(-1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(-1);
         break;
     case ContextMenuItemTagGoForward:
-        frame->loader()->goBackOrForward(1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(1);
         break;
     case ContextMenuItemTagStop:
         frame->loader()->stop();
@@ -215,7 +217,7 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         break;
     case ContextMenuItemTagOpenLink:
         if (Frame* targetFrame = result.targetFrame())
-            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0);
+            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0, SendReferrer);
         else
             openNewWindow(result.absoluteLinkURL(), frame);
         break;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index 5ac4049..c30b6b9 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -64,6 +64,7 @@
 #include "PlatformString.h"
 #include "Screen.h"
 #include "SecurityOrigin.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
 #include "Storage.h"
 #include "StorageArea.h"
@@ -80,7 +81,7 @@ namespace WebCore {
 
 class PostMessageTimer : public TimerBase {
 public:
-    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
+    PostMessageTimer(DOMWindow* window, PassRefPtr<SerializedScriptValue> message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
         : m_window(window)
         , m_message(message)
         , m_origin(sourceOrigin)
@@ -104,7 +105,7 @@ private:
     }
 
     RefPtr<DOMWindow> m_window;
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     String m_origin;
     RefPtr<DOMWindow> m_source;
     OwnPtr<MessagePortChannelArray> m_channels;
@@ -635,7 +636,7 @@ NotificationCenter* DOMWindow::webkitNotifications() const
 }
 #endif
 
-void DOMWindow::postMessage(const String& message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -643,7 +644,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* port, const Stri
     postMessage(message, &ports, targetOrigin, source, ec);
 }
 
-void DOMWindow::postMessage(const String& message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     if (!m_frame)
         return;
@@ -739,12 +740,9 @@ void DOMWindow::close()
         return;
 
     Settings* settings = m_frame->settings();
-    bool allowScriptsToCloseWindows =
-        settings && settings->allowScriptsToCloseWindows();
+    bool allowScriptsToCloseWindows = settings && settings->allowScriptsToCloseWindows();
 
-    if (m_frame->loader()->openedByDOM()
-        || m_frame->loader()->getHistoryLength() <= 1
-        || allowScriptsToCloseWindows)
+    if (page->openedByDOM() || page->getHistoryLength() <= 1 || allowScriptsToCloseWindows)
         m_frame->scheduleClose();
 }
 
@@ -1296,6 +1294,14 @@ void DOMWindow::dispatchLoadEvent()
         ownerEvent->setTarget(ownerElement);
         ownerElement->dispatchGenericEvent(ownerEvent.release());
     }
+
+#if ENABLE(INSPECTOR)
+    if (!frame() || !frame()->page())
+        return;
+
+    if (InspectorController* controller = frame()->page()->inspectorController())
+        controller->mainResourceFiredLoadEvent(frame()->loader()->documentLoader(), url());
+#endif
 }
 
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index f2177ee..25eadc8 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -59,6 +59,7 @@ namespace WebCore {
     class NotificationCenter;
     class PostMessageTimer;
     class ScheduledAction;
+    class SerializedScriptValue;
     class Screen;
     class WebKitPoint;
 
@@ -214,9 +215,9 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
-        void postMessage(const String& message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String& message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         void postMessageTimerFired(PostMessageTimer*);
 
         void scrollBy(int x, int y) const;
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 4e3a03e..4587001 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -182,11 +182,11 @@ module window {
 
         // cross-document messaging
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts, in DOMString targetOrigin)
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] Array messagePorts, in DOMString targetOrigin)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
             raises(DOMException);
 #endif
 
@@ -434,16 +434,17 @@ module window {
         attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
         attribute TextMetricsConstructor TextMetrics;
 
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
 
         attribute EventConstructor Event;
+        attribute BeforeLoadEventConstructor BeforeLoadEvent;
         attribute KeyboardEventConstructor KeyboardEvent;
         attribute MouseEventConstructor MouseEvent;
         attribute MutationEventConstructor MutationEvent;
@@ -501,11 +502,11 @@ module window {
 #endif
 
 #if defined(ENABLE_SHARED_WORKERS) && ENABLE_SHARED_WORKERS
-        attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+        attribute [JSCCustomGetter, EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
 #endif
 
 #if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
-        attribute [JSCCustomGetter] WebSocketConstructor WebSocket; // Usable with the new operator
+        attribute [JSCCustomGetter,EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
 #endif
 
         attribute PluginConstructor Plugin;
@@ -522,11 +523,11 @@ module window {
         attribute StorageEventConstructor StorageEvent;
 #endif
 
-        attribute [CustomGetter,Conditional=VIDEO] HTMLAudioElementConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO] MediaErrorConstructor MediaError;
+        attribute [CustomGetter, Conditional=VIDEO, EnabledAtRuntime] HTMLAudioElementConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] MediaErrorConstructor MediaError;
 
 #if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
@@ -559,7 +560,7 @@ module window {
         attribute SVGFECompositeElementConstructor SVGFECompositeElement;
 //      attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
         attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-//      attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
 #endif
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index ab3a653..634595a 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -649,6 +649,12 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
 
     if (isDHTMLDrag)
         dragImage = clipboard->createDragImage(dragImageOffset);
+    else {
+        // This drag operation is not a DHTML drag and may go outside the WebView.
+        // We provide a default set of allowed drag operations that follows from:
+        // http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430
+        m_sourceDragOperation = (DragOperation)(DragOperationGeneric | DragOperationCopy);
+    }
 
     // We allow DHTML/JS to set the drag image, even if its a link, image or text we're dragging.
     // This is in the spirit of the IE API, which allows overriding of pasteboard data and DragOp.
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 1075e72..4e97aba 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -127,10 +127,12 @@ inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResu
     return false;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 inline bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
     return false;
 }
+#endif
 
 #endif
 
@@ -1528,15 +1530,15 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
         if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                            ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
             if (frame)
                 accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
@@ -1544,8 +1546,9 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         }
     } else {
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
         }
@@ -2178,7 +2181,7 @@ void EventHandler::freeClipboard()
 
 bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
 {
-    if (!node || node->hasChildNodes() || !m_frame->view())
+    if (!node || !m_frame->view())
         return false;
     Page* page = m_frame->page();
     return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.cpp b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
index ae3c0c3..2c9a343 100644
--- a/src/3rdparty/webkit/WebCore/page/EventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
@@ -45,6 +45,7 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptExecutionContext.h"
+#include "SerializedScriptValue.h"
 #include "TextResourceDecoder.h"
 #include "ThreadableLoader.h"
 
@@ -294,7 +295,7 @@ void EventSource::stop()
 PassRefPtr<MessageEvent> EventSource::createMessageEvent()
 {
     RefPtr<MessageEvent> event = MessageEvent::create();
-    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, String::adopt(m_data), m_origin, m_lastEventId, 0, 0);
+    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, SerializedScriptValue::create(String::adopt(m_data)), m_origin, m_lastEventId, 0, 0);
     return event.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index e8e796f..fab7e3f 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -123,6 +123,7 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     : m_page(page)
     , m_treeNode(this, parentFromOwnerElement(ownerElement))
     , m_loader(this, frameLoaderClient)
+    , m_redirectScheduler(this)
     , m_ownerElement(ownerElement)
     , m_script(this)
     , m_selectionGranularity(CharacterGranularity)
@@ -197,6 +198,7 @@ Frame::~Frame()
 
     if (m_domWindow)
         m_domWindow->disconnectFrame();
+    script()->clearWindowShell();
 
     HashSet<DOMWindow*>::iterator end = m_liveFormerWindows.end();
     for (HashSet<DOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
@@ -220,6 +222,11 @@ FrameLoader* Frame::loader() const
     return &m_loader;
 }
 
+RedirectScheduler* Frame::redirectScheduler() const
+{
+    return &m_redirectScheduler;
+}
+
 FrameView* Frame::view() const
 {
     return m_view.get();
@@ -875,12 +882,11 @@ void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&
     if (!doc)
         return;
 
-    // FIXME: Need to implement pattern checking.
     Vector<ScriptSourceCode> sourceCode;
     unsigned count = userScripts.size();
     for (unsigned i = 0; i < count; ++i) {
         UserScript* script = userScripts[i].get();
-        if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->patterns()))
+        if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
             sourceCode.append(ScriptSourceCode(script->source(), script->url()));
     }
     script()->evaluateInIsolatedWorld(worldID, sourceCode);
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.h b/src/3rdparty/webkit/WebCore/page/Frame.h
index b98dbc4..6208bbd 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.h
+++ b/src/3rdparty/webkit/WebCore/page/Frame.h
@@ -67,6 +67,7 @@ namespace WebCore {
     class Editor;
     class EventHandler;
     class FrameLoader;
+    class RedirectScheduler;
     class FrameLoaderClient;
     class FrameTree;
     class FrameView;
@@ -110,6 +111,7 @@ namespace WebCore {
         Editor* editor() const;
         EventHandler* eventHandler() const;
         FrameLoader* loader() const;
+        RedirectScheduler* redirectScheduler() const;
         SelectionController* selection() const;
         FrameTree* tree() const;
         AnimationController* animation() const;
@@ -334,6 +336,7 @@ namespace WebCore {
         Page* m_page;
         mutable FrameTree m_treeNode;
         mutable FrameLoader m_loader;
+        mutable RedirectScheduler m_redirectScheduler;
 
         mutable RefPtr<DOMWindow> m_domWindow;
         HashSet<DOMWindow*> m_liveFormerWindows;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 675cba1..bc4e4f2 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -52,12 +52,24 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
+#include "TextResourceDecoder.h"
 #include <wtf/CurrentTime.h>
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
 #endif
 
+#if ENABLE(SVG)
+#include "SVGDocument.h"
+#include "SVGLocatable.h"
+#include "SVGNames.h"
+#include "SVGPreserveAspectRatio.h"
+#include "SVGSVGElement.h"
+#include "SVGViewElement.h"
+#include "SVGViewSpec.h"
+#endif
+
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -640,6 +652,7 @@ void FrameView::layout(bool allowSubtree)
     beginDeferredRepaints();
     layer->updateLayerPositions((m_doFullRepaint ? RenderLayer::DoFullRepaint : 0)
                                 | RenderLayer::CheckForRepaint
+                                | RenderLayer::IsCompositingUpdateRoot
                                 | RenderLayer::UpdateCompositingLayers);
     endDeferredRepaints();
 
@@ -769,6 +782,72 @@ void FrameView::restoreScrollbar()
     setScrollbarsSuppressed(false);
 }
 
+bool FrameView::scrollToFragment(const KURL& url)
+{
+    // If our URL has no ref, then we have no place we need to jump to.
+    // OTOH If CSS target was set previously, we want to set it to 0, recalc
+    // and possibly repaint because :target pseudo class may have been
+    // set (see bug 11321).
+    if (!url.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
+        return false;
+
+    String fragmentIdentifier = url.fragmentIdentifier();
+    if (scrollToAnchor(fragmentIdentifier))
+        return true;
+
+    // Try again after decoding the ref, based on the document's encoding.
+    if (TextResourceDecoder* decoder = m_frame->document()->decoder())
+        return scrollToAnchor(decodeURLEscapeSequences(fragmentIdentifier, decoder->encoding()));
+
+    return false;
+}
+
+bool FrameView::scrollToAnchor(const String& name)
+{
+    ASSERT(m_frame->document());
+
+    if (!m_frame->document()->haveStylesheetsLoaded()) {
+        m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(true);
+        return false;
+    }
+
+    m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(false);
+
+    Element* anchorNode = m_frame->document()->findAnchor(name);
+
+#if ENABLE(SVG)
+    if (m_frame->document()->isSVGDocument()) {
+        if (name.startsWith("xpointer(")) {
+            // We need to parse the xpointer reference here
+        } else if (name.startsWith("svgView(")) {
+            RefPtr<SVGSVGElement> svg = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+            if (!svg->currentView()->parseViewSpec(name))
+                return false;
+            svg->setUseCurrentView(true);
+        } else {
+            if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
+                RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
+                if (viewElement.get()) {
+                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
+                    svg->inheritViewAttributes(viewElement.get());
+                }
+            }
+        }
+        // FIXME: need to decide which <svg> to focus on, and zoom to that one
+        // FIXME: need to actually "highlight" the viewTarget(s)
+    }
+#endif
+
+    m_frame->document()->setCSSTarget(anchorNode); // Setting to null will clear the current target.
+  
+    // Implement the rule that "" and "top" both mean top of page as in other browsers.
+    if (!anchorNode && !(name.isEmpty() || equalIgnoringCase(name, "top")))
+        return false;
+
+    maintainScrollPositionAtAnchor(anchorNode ? static_cast<Node*>(anchorNode) : m_frame->document());
+    return true;
+}
+
 void FrameView::maintainScrollPositionAtAnchor(Node* anchorNode)
 {
     m_maintainScrollPositionAnchor = anchorNode;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 4c900ae..3d17d2c 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -183,6 +183,8 @@ public:
 
     void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
 
+    bool scrollToFragment(const KURL&);
+    bool scrollToAnchor(const String&);
     void maintainScrollPositionAtAnchor(Node*);
 
     // Methods to convert points and rects between the coordinate space of the renderer, and this view.
diff --git a/src/3rdparty/webkit/WebCore/page/History.cpp b/src/3rdparty/webkit/WebCore/page/History.cpp
index 2527132..9a27f1c 100644
--- a/src/3rdparty/webkit/WebCore/page/History.cpp
+++ b/src/3rdparty/webkit/WebCore/page/History.cpp
@@ -50,28 +50,30 @@ unsigned History::length() const
 {
     if (!m_frame)
         return 0;
-    return m_frame->loader()->getHistoryLength();
+    if (!m_frame->page())
+        return 0;
+    return m_frame->page()->getHistoryLength();
 }
 
 void History::back()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(-1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(-1);
 }
 
 void History::forward()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(1);
 }
 
 void History::go(int distance)
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(distance);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index 2d0c91c..8a685f4 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -119,6 +119,7 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_theme(RenderTheme::themeForPage(this))
     , m_editorClient(editorClient)
     , m_frameCount(0)
+    , m_openedByDOM(false)
     , m_tabKeyCyclesThroughElements(true)
     , m_defersLoading(false)
     , m_inLowQualityInterpolationMode(false)
@@ -136,7 +137,6 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
     , m_canStartPlugins(true)
-    , m_pluginHalterClient(pluginHalterClient)
 {
 #if !ENABLE(CONTEXT_MENUS)
     UNUSED_PARAM(contextMenuClient);
@@ -156,7 +156,10 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     ASSERT(!allPages->contains(this));
     allPages->add(this);
 
-    pluginHalterEnabledStateChanged();
+    if (pluginHalterClient) {
+        m_pluginHalter.set(new PluginHalter(pluginHalterClient));
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+    }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     JavaScriptDebugServer::shared().pageCreated(this);
@@ -201,6 +204,16 @@ void Page::setMainFrame(PassRefPtr<Frame> mainFrame)
     m_mainFrame = mainFrame;
 }
 
+bool Page::openedByDOM() const
+{
+    return m_openedByDOM;
+}
+
+void Page::setOpenedByDOM()
+{
+    m_openedByDOM = true;
+}
+
 BackForwardList* Page::backForwardList()
 {
     return m_backForwardList.get();
@@ -228,6 +241,40 @@ bool Page::goForward()
     return false;
 }
 
+bool Page::canGoBackOrForward(int distance) const
+{
+    if (distance == 0)
+        return true;
+    if (distance > 0 && distance <= m_backForwardList->forwardListCount())
+        return true;
+    if (distance < 0 && -distance <= m_backForwardList->backListCount())
+        return true;
+    return false;
+}
+
+void Page::goBackOrForward(int distance)
+{
+    if (distance == 0)
+        return;
+
+    HistoryItem* item = m_backForwardList->itemAtIndex(distance);
+    if (!item) {
+        if (distance > 0) {
+            int forwardListCount = m_backForwardList->forwardListCount();
+            if (forwardListCount > 0) 
+                item = m_backForwardList->itemAtIndex(forwardListCount);
+        } else {
+            int backListCount = m_backForwardList->backListCount();
+            if (backListCount > 0)
+                item = m_backForwardList->itemAtIndex(-backListCount);
+        }
+    }
+
+    ASSERT(item); // we should not reach this line with an empty back/forward list
+    if (item)
+        goToItem(item, FrameLoadTypeIndexedBackForward);
+}
+
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
     // Abort any current load if we're going to a history item
@@ -244,7 +291,12 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
         databasePolicy = DatabasePolicyContinue;
 #endif
     m_mainFrame->loader()->stopAllLoaders(databasePolicy);
-    m_mainFrame->loader()->goToItem(item, type);
+    m_mainFrame->loader()->history()->goToItem(item, type);
+}
+
+int Page::getHistoryLength()
+{
+    return m_backForwardList->backListCount() + 1;
 }
 
 void Page::setGlobalHistoryItem(HistoryItem* item)
@@ -683,16 +735,6 @@ InspectorTimelineAgent* Page::inspectorTimelineAgent() const
 }
 #endif
 
-void Page::pluginHalterEnabledStateChanged()
-{
-    if (m_settings->pluginHalterEnabled()) {
-        ASSERT(!m_pluginHalter);
-        m_pluginHalter.set(new PluginHalter(m_pluginHalterClient));
-        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
-    } else
-        m_pluginHalter = 0;
-}
-
 void Page::pluginAllowedRunTimeChanged()
 {
     if (m_pluginHalter)
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index 602d99b..4886464 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -103,6 +103,9 @@ namespace WebCore {
         void setMainFrame(PassRefPtr<Frame>);
         Frame* mainFrame() const { return m_mainFrame.get(); }
 
+        bool openedByDOM() const;
+        void setOpenedByDOM();
+
         BackForwardList* backForwardList();
 
         // FIXME: The following three methods don't fall under the responsibilities of the Page object
@@ -111,7 +114,10 @@ namespace WebCore {
         // makes more sense when that class exists.
         bool goBack();
         bool goForward();
+        bool canGoBackOrForward(int distance) const;
+        void goBackOrForward(int distance);
         void goToItem(HistoryItem*, FrameLoadType);
+        int getHistoryLength();
 
         HistoryItem* globalHistoryItem() const { return m_globalHistoryItem.get(); }
         void setGlobalHistoryItem(HistoryItem*);
@@ -187,7 +193,6 @@ namespace WebCore {
         void didStartPlugin(HaltablePlugin*);
         void didStopPlugin(HaltablePlugin*);
         void pluginAllowedRunTimeChanged();
-        void pluginHalterEnabledStateChanged();
 
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
@@ -261,6 +266,7 @@ namespace WebCore {
 
         int m_frameCount;
         String m_groupName;
+        bool m_openedByDOM;
 
         bool m_tabKeyCyclesThroughElements;
         bool m_defersLoading;
@@ -293,7 +299,6 @@ namespace WebCore {
         HashSet<PluginView*> m_unstartedPlugins;
 
         OwnPtr<PluginHalter> m_pluginHalter;
-        PluginHalterClient* m_pluginHalterClient;
 
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
index f9855a7..427c240 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
@@ -191,20 +191,21 @@ StorageNamespace* PageGroup::localStorage()
     if (!m_localStorage) {
         // Need a page in this page group to query the settings for the local storage database path.
         Page* page = *m_pages.begin();
-        ASSERT(page);
-        m_localStorage = StorageNamespace::localStorageNamespace(page->settings()->localStorageDatabasePath());
+        const String& path = page->settings()->localStorageDatabasePath();
+        unsigned quota = page->settings()->localStorageQuota();
+        m_localStorage = StorageNamespace::localStorageNamespace(path, quota);
     }
 
     return m_localStorage.get();
 }
 #endif
 
-void PageGroup::addUserScript(const String& source, const KURL& url, const Vector<String>& patterns, 
-                              unsigned worldID, UserScriptInjectionTime injectionTime)
+void PageGroup::addUserScriptToWorld(unsigned worldID, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+                                     PassOwnPtr<Vector<String> > blacklist, UserScriptInjectionTime injectionTime)
 {
     if (worldID == UINT_MAX)
         return;
-    OwnPtr<UserScript> userScript(new UserScript(source, url, patterns, worldID, injectionTime));
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
     if (!m_userScripts)
         m_userScripts.set(new UserScriptMap);
     UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
@@ -213,11 +214,12 @@ void PageGroup::addUserScript(const String& source, const KURL& url, const Vecto
     scriptsInWorld->append(userScript.release());
 }
 
-void PageGroup::addUserStyleSheet(const String& source, const KURL& url, const Vector<String>& patterns, unsigned worldID)
+void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+                                         PassOwnPtr<Vector<String> > blacklist)
 {
     if (worldID == UINT_MAX)
         return;
-    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, patterns, worldID));
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
     if (!m_userStyleSheets)
         m_userStyleSheets.set(new UserStyleSheetMap);
     UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
@@ -233,23 +235,93 @@ void PageGroup::addUserStyleSheet(const String& source, const KURL& url, const V
     }
 }
 
-void PageGroup::removeUserContentForWorld(unsigned worldID)
+void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
 {
-    if (m_userScripts) {
-        UserScriptMap::iterator it = m_userScripts->find(worldID);
-        if (it != m_userScripts->end()) {
-            m_userScripts->remove(it);
-            delete it->second;
-        }
+    if (!m_userScripts)
+        return;
+
+    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    if (it == m_userScripts->end())
+        return;
+    
+    UserScriptVector* scripts = it->second;
+    for (int i = scripts->size() - 1; i >= 0; --i) {
+        if (scripts->at(i)->url() == url)
+            scripts->remove(i);
     }
     
-    if (m_userStyleSheets) {
-        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
-        if (it != m_userStyleSheets->end()) {
-            m_userStyleSheets->remove(it);
-            delete it->second;
+    if (!scripts->isEmpty())
+        return;
+    
+    delete it->second;
+    m_userScripts->remove(it);
+}
+
+void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
+{
+    if (!m_userStyleSheets)
+        return;
+
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    bool sheetsChanged = false;
+    if (it == m_userStyleSheets->end())
+        return;
+    
+    UserStyleSheetVector* stylesheets = it->second;
+    for (int i = stylesheets->size() - 1; i >= 0; --i) {
+        if (stylesheets->at(i)->url() == url) {
+            stylesheets->remove(i);
+            sheetsChanged = true;
         }
     }
+        
+    if (!sheetsChanged)
+        return;
+
+    if (!stylesheets->isEmpty()) {
+        delete it->second;
+        m_userStyleSheets->remove(it);
+    }
+    
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
+}
+
+void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
+{
+    if (!m_userScripts)
+        return;
+
+    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    if (it == m_userScripts->end())
+        return;
+       
+    delete it->second;
+    m_userScripts->remove(it);
+}
+
+void PageGroup::removeUserStyleSheetsFromWorld(unsigned worldID)
+{
+    if (!m_userStyleSheets)
+        return;
+    
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    if (it == m_userStyleSheets->end())
+        return;
+    
+    delete it->second;
+    m_userStyleSheets->remove(it);
+
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
 }
 
 void PageGroup::removeAllUserContent()
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.h b/src/3rdparty/webkit/WebCore/page/PageGroup.h
index 0bf3fbc..c233cd1 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.h
@@ -70,16 +70,23 @@ namespace WebCore {
         bool hasLocalStorage() { return m_localStorage; }
 #endif
 
-        void addUserScript(const String& source, const KURL&, const Vector<String>& patterns,
-                           unsigned worldID, UserScriptInjectionTime);
-        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        void addUserScriptToWorld(unsigned worldID, const String& source, const KURL&, 
+                                  PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                                  UserScriptInjectionTime);
+        void addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL&,
+                               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist);
         
-        void addUserStyleSheet(const String& source, const KURL&, const Vector<String>& patterns, unsigned worldID);
-        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+        void removeUserScriptFromWorld(unsigned, const KURL&);
+        void removeUserStyleSheetFromWorld(unsigned, const KURL&);
         
-        void removeUserContentForWorld(unsigned);
+        void removeUserScriptsFromWorld(unsigned);
+        void removeUserStyleSheetsFromWorld(unsigned);
+    
         void removeAllUserContent();
         
+        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+
     private:
         void addVisitedLink(LinkHash stringHash);
 
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
index 8025337..63f5469 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
@@ -28,7 +28,6 @@
 #include "PluginHalter.h"
 
 #include "HaltablePlugin.h"
-#include "PluginHalterClient.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -49,6 +48,9 @@ void PluginHalter::didStartPlugin(HaltablePlugin* obj)
     ASSERT_ARG(obj, obj);
     ASSERT_ARG(obj, !m_plugins.contains(obj));
 
+    if (!m_client->enabled())
+        return;
+
     double currentTime = WTF::currentTime();
 
     m_plugins.add(obj, currentTime);
@@ -61,6 +63,9 @@ void PluginHalter::didStartPlugin(HaltablePlugin* obj)
 
 void PluginHalter::didStopPlugin(HaltablePlugin* obj)
 {
+    if (!m_client->enabled())
+        return;
+
     m_plugins.remove(obj);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.h b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
index 26f5101..eddce34 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalter.h
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
@@ -26,13 +26,14 @@
 #ifndef PluginHalter_h
 #define PluginHalter_h
 
+#include "PluginHalterClient.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 class HaltablePlugin;
-class PluginHalterClient;
 
 class PluginHalter {
 public:
@@ -47,7 +48,7 @@ private:
     void timerFired(Timer<PluginHalter>*);
     void startTimerIfNecessary();
 
-    PluginHalterClient* m_client;
+    OwnPtr<PluginHalterClient> m_client;
     Timer<PluginHalter> m_timer;
     unsigned m_pluginAllowedRunTime;
     double m_oldestStartTime;
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
index 7ea460a..f77091f 100644
--- a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
@@ -35,6 +35,7 @@ public:
     virtual ~PluginHalterClient() { }
 
     virtual bool shouldHaltPlugin(Node*) const = 0;
+    virtual bool enabled() const = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
index 4d3a839..bba678a 100644
--- a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
@@ -25,6 +25,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 using namespace WebCore;
 
@@ -95,18 +96,23 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
 void PrintContext::begin(float width)
 {
-    // By imaging to a width a little wider than the available pixels,
-    // thin pages will be scaled down a little, matching the way they
-    // print in IE and Camino. This lets them use fewer sheets than they
-    // would otherwise, which is presumably why other browsers do this.
-    // Wide pages will be scaled down more than this.
-    const float PrintingMinimumShrinkFactor = 1.25f;
-
-    // This number determines how small we are willing to reduce the page content
-    // in order to accommodate the widest line. If the page would have to be
-    // reduced smaller to make the widest line fit, we just clip instead (this
-    // behavior matches MacIE and Mozilla, at least)
-    const float PrintingMaximumShrinkFactor = 2.0f;
+    float PrintingMinimumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMinimumShrinkFactor() : 0.0f;
+    float PrintingMaximumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMaximumShrinkFactor() : 0.0f;
+
+    if (PrintingMaximumShrinkFactor < PrintingMinimumShrinkFactor || PrintingMinimumShrinkFactor <= 0.0f) {
+        // By imaging to a width a little wider than the available pixels,
+        // thin pages will be scaled down a little, matching the way they
+        // print in IE and Camino. This lets them use fewer sheets than they
+        // would otherwise, which is presumably why other browsers do this.
+        // Wide pages will be scaled down more than this.
+        PrintingMinimumShrinkFactor = 1.25f;
+
+        // This number determines how small we are willing to reduce the page content
+        // in order to accommodate the widest line. If the page would have to be
+        // reduced smaller to make the widest line fit, we just clip instead (this
+        // behavior matches MacIE and Mozilla, at least)
+        PrintingMaximumShrinkFactor = 2.0f;
+    }
 
     float minLayoutWidth = width * PrintingMinimumShrinkFactor;
     float maxLayoutWidth = width * PrintingMaximumShrinkFactor;
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index b91c1f1..338bf9f 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -30,13 +30,15 @@
 #include "SecurityOrigin.h"
 
 #include "CString.h"
-#include "FrameLoader.h"
+#include "Document.h"
 #include "KURL.h"
 #include "OriginAccessEntry.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+static SecurityOrigin::LocalLoadPolicy localLoadPolicy = SecurityOrigin::AllowLocalLoadsForLocalOnly;
+
 typedef Vector<OriginAccessEntry> OriginAccessWhiteList;
 typedef HashMap<String, OriginAccessWhiteList*> OriginAccessMap;
 
@@ -116,9 +118,9 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 }
 
 SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
-    : m_protocol(other->m_protocol.copy())
-    , m_host(other->m_host.copy())
-    , m_domain(other->m_domain.copy())
+    : m_protocol(other->m_protocol.threadsafeCopy())
+    , m_host(other->m_host.threadsafeCopy())
+    , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
     , m_noAccess(other->m_noAccess)
     , m_universalAccess(other->m_universalAccess)
@@ -144,7 +146,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createEmpty()
     return create(KURL());
 }
 
-PassRefPtr<SecurityOrigin> SecurityOrigin::copy()
+PassRefPtr<SecurityOrigin> SecurityOrigin::threadsafeCopy()
 {
     return adoptRef(new SecurityOrigin(this));
 }
@@ -237,6 +239,20 @@ bool SecurityOrigin::taintsCanvas(const KURL& url) const
     return true;
 }
 
+bool SecurityOrigin::canLoad(const KURL& url, const String& referrer, Document* document)
+{
+    if (!shouldTreatURLAsLocal(url.string()))
+        return true;
+
+    // If we were provided a document, we let its local file policy dictate the result,
+    // otherwise we allow local loads only if the supplied referrer is also local.
+    if (document)
+        return document->securityOrigin()->canLoadLocalResources();
+    if (!referrer.isEmpty())
+        return shouldTreatURLAsLocal(referrer);
+    return false;
+}
+
 void SecurityOrigin::grantLoadLocalResources()
 {
     // This method exists only to support backwards compatibility with older
@@ -244,7 +260,7 @@ void SecurityOrigin::grantLoadLocalResources()
     // in a SecurityOrigin is a security hazard because the documents without
     // the privilege can obtain the privilege by injecting script into the
     // documents that have been granted the privilege.
-    ASSERT(FrameLoader::allowSubstituteDataAccessToLocal());
+    ASSERT(allowSubstituteDataAccessToLocal());
     m_canLoadLocalResources = true;
 }
 
@@ -370,13 +386,11 @@ bool SecurityOrigin::isSameSchemeHostPort(const SecurityOrigin* other) const
     return true;
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsLocal(const String& scheme)
 {
     localSchemes().add(scheme);
 }
 
-// static
 void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
 {
     if (scheme == "file")
@@ -392,13 +406,11 @@ void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
     localSchemes().remove(scheme);
 }
 
-// static
 const URLSchemesMap&  SecurityOrigin::localURLSchemes()
 {
     return localSchemes();
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -419,7 +431,6 @@ bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
     return localSchemes().contains(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -438,18 +449,47 @@ bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
     return localSchemes().contains(scheme);
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsNoAccess(const String& scheme)
 {
     noAccessSchemes().add(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsNoAccess(const String& scheme)
 {
     return noAccessSchemes().contains(scheme);
 }
 
+bool SecurityOrigin::shouldHideReferrer(const KURL& url, const String& referrer)
+{
+    bool referrerIsSecureURL = protocolIs(referrer, "https");
+    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
+
+    if (!referrerIsWebURL)
+        return true;
+
+    if (!referrerIsSecureURL)
+        return false;
+
+    bool URLIsSecureURL = url.protocolIs("https");
+
+    return !URLIsSecureURL;
+}
+
+void SecurityOrigin::setLocalLoadPolicy(LocalLoadPolicy policy)
+{
+    localLoadPolicy = policy;
+}
+
+bool SecurityOrigin::restrictAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForAll;
+}
+
+bool SecurityOrigin::allowSubstituteDataAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForLocalOnly;
+}
+
 void SecurityOrigin::whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains)
 {
     ASSERT(isMainThread());
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index 732afa8..46e6fad 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -40,7 +40,8 @@
 namespace WebCore {
 
     typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
-    
+
+    class Document;
     class KURL;
     
     class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
@@ -52,7 +53,7 @@ namespace WebCore {
 
         // Create a deep copy of this SecurityOrigin.  This method is useful
         // when marshalling a SecurityOrigin to another thread.
-        PassRefPtr<SecurityOrigin> copy();
+        PassRefPtr<SecurityOrigin> threadsafeCopy();
 
         // Set the domain property of this security origin to newDomain.  This
         // function does not check whether newDomain is a suffix of the current
@@ -81,6 +82,11 @@ namespace WebCore {
         // drawing an image onto an HTML canvas element with the drawImage API.
         bool taintsCanvas(const KURL&) const;
 
+        // Returns true for any non-local URL. If document parameter is supplied,
+        // its local load policy dictates, otherwise if referrer is non-empty and
+        // represents a local file, then the local load is allowed.
+        static bool canLoad(const KURL&, const String& referrer, Document* document);
+
         // Returns true if this SecurityOrigin can load local resources, such
         // as images, iframes, and style sheets, and can link to local URLs.
         // For example, call this function before creating an iframe to a
@@ -143,6 +149,17 @@ namespace WebCore {
         static bool shouldTreatURLAsLocal(const String&);
         static bool shouldTreatURLSchemeAsLocal(const String&);
 
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
+
+        enum LocalLoadPolicy {
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
+        };
+        static void setLocalLoadPolicy(LocalLoadPolicy);
+        static bool restrictAccessToLocal();
+        static bool allowSubstituteDataAccessToLocal();
+
         static void registerURLSchemeAsNoAccess(const String&);
         static bool shouldTreatURLSchemeAsNoAccess(const String&);
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index ab438a1..48f310b 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -61,7 +61,10 @@ Settings::Settings(Page* page)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
+    , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+    , m_printingMinimumShrinkFactor(0.0f)
+    , m_printingMaximumShrinkFactor(0.0f)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -116,11 +119,7 @@ Settings::Settings(Page* page)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
     , m_experimentalNotificationsEnabled(false)
-    , m_pluginHalterEnabled(false)
-    , m_experimentalWebGLEnabled(false)
-#if ENABLE(WEB_SOCKETS)
-    , m_experimentalWebSocketsEnabled(false)
-#endif
+    , m_webGLEnabled(false)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -262,6 +261,11 @@ void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
     m_sessionStorageEnabled = sessionStorageEnabled;
 }
 
+void Settings::setLocalStorageQuota(unsigned localStorageQuota)
+{
+    m_localStorageQuota = localStorageQuota;
+}
+
 void Settings::setPrivateBrowsingEnabled(bool privateBrowsingEnabled)
 {
     m_privateBrowsingEnabled = privateBrowsingEnabled;
@@ -509,16 +513,6 @@ void Settings::setExperimentalNotificationsEnabled(bool enabled)
     m_experimentalNotificationsEnabled = enabled;
 }
 
-void Settings::setPluginHalterEnabled(bool enabled)
-{
-    if (m_pluginHalterEnabled == enabled)
-        return;
-
-    m_pluginHalterEnabled = enabled;
-
-    m_page->pluginHalterEnabledStateChanged();
-}
-
 void Settings::setPluginAllowedRunTime(unsigned runTime)
 {
     m_pluginAllowedRunTime = runTime;
@@ -532,16 +526,19 @@ void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTime
 }
 #endif
 
-void Settings::setExperimentalWebGLEnabled(bool enabled)
+void Settings::setWebGLEnabled(bool enabled)
 {
-    m_experimentalWebGLEnabled = enabled;
+    m_webGLEnabled = enabled;
 }
 
-#if ENABLE(WEB_SOCKETS)
-void Settings::setExperimentalWebSocketsEnabled(bool enabled)
+void Settings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
 {
-    m_experimentalWebSocketsEnabled = enabled;
-}
-#endif
+    m_printingMinimumShrinkFactor = printingMinimumShrinkFactor;
+}    
+
+void Settings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+{
+    m_printingMaximumShrinkFactor = printingMaximumShrinkFactor;
+}    
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index ec9c8f9..bdb07b9 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -128,6 +128,9 @@ namespace WebCore {
         void setSessionStorageEnabled(bool);
         bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
 
+        void setLocalStorageQuota(unsigned);
+        unsigned localStorageQuota() const { return m_localStorageQuota; }
+
         void setPrivateBrowsingEnabled(bool);
         bool privateBrowsingEnabled() const { return m_privateBrowsingEnabled; }
 
@@ -261,21 +264,17 @@ namespace WebCore {
         static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
 #endif
 
-        void setPluginHalterEnabled(bool);
-        bool pluginHalterEnabled() const { return m_pluginHalterEnabled; }
-
         void setPluginAllowedRunTime(unsigned);
         unsigned pluginAllowedRunTime() const { return m_pluginAllowedRunTime; }
 
-        // This run-time flag is only temporary while the WebGL
-        // specification is being developed.
-        void setExperimentalWebGLEnabled(bool);
-        bool experimentalWebGLEnabled() const { return m_experimentalWebGLEnabled; }
+        void setWebGLEnabled(bool);
+        bool webGLEnabled() const { return m_webGLEnabled; }
 
-#if ENABLE(WEB_SOCKETS)
-        void setExperimentalWebSocketsEnabled(bool);
-        bool experimentalWebSocketsEnabled() const { return m_experimentalWebSocketsEnabled; }
-#endif
+        void setPrintingMinimumShrinkFactor(float);
+        float printingMinimumShrinkFactor() const { return m_printingMinimumShrinkFactor; }
+
+        void setPrintingMaximumShrinkFactor(float);
+        float printingMaximumShrinkFactor() const { return m_printingMaximumShrinkFactor; }
 
     private:
         Page* m_page;
@@ -297,7 +296,10 @@ namespace WebCore {
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
         size_t m_maximumDecodedImageSize;
+        unsigned m_localStorageQuota;
         unsigned m_pluginAllowedRunTime;
+        float m_printingMinimumShrinkFactor;
+        float m_printingMaximumShrinkFactor;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -343,12 +345,7 @@ namespace WebCore {
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
         bool m_experimentalNotificationsEnabled : 1;
-        bool m_pluginHalterEnabled : 1;
-        bool m_experimentalWebGLEnabled : 1;
-
-#if ENABLE(WEB_SOCKETS)
-        bool m_experimentalWebSocketsEnabled : 1;
-#endif
+        bool m_webGLEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp
index 1960131..5f0a311 100644
--- a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.cpp
@@ -30,19 +30,33 @@
 
 namespace WebCore {
 
-bool UserContentURLPattern::matchesPatterns(const KURL& url, const Vector<String>& patterns)
+bool UserContentURLPattern::matchesPatterns(const KURL& url, const Vector<String>* whitelist, const Vector<String>* blacklist)
 {
-    // Treat no patterns at all as though a pattern of * was specified.
-    if (patterns.isEmpty())
-        return true;
+    // In order for a URL to be a match it has to be present in the whitelist and not present in the blacklist.
+    // If there is no whitelist at all, then all URLs are assumed to be in the whitelist.
+    bool matchesWhitelist = !whitelist || whitelist->isEmpty();
+    if (!matchesWhitelist) {
+        for (unsigned i = 0; i < whitelist->size(); ++i) {
+            UserContentURLPattern contentPattern(whitelist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesWhitelist = true;
+                break;
+            }
+        }
+    }
 
-    for (unsigned i = 0; i < patterns.size(); ++i) {
-        UserContentURLPattern contentPattern(patterns[i]);
-        if (contentPattern.matches(url))
-            return true;
+    bool matchesBlacklist = false;
+    if (blacklist) {
+        for (unsigned i = 0; i < blacklist->size(); ++i) {
+            UserContentURLPattern contentPattern(blacklist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesBlacklist = true;
+                break;
+            }
+        }
     }
 
-    return false;
+    return matchesWhitelist && !matchesBlacklist;
 }
 
 bool UserContentURLPattern::parse(const String& pattern)
diff --git a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h
index bc87f55..0b1a248 100644
--- a/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h
+++ b/src/3rdparty/webkit/WebCore/page/UserContentURLPattern.h
@@ -49,7 +49,7 @@ public:
 
     bool matchSubdomains() const { return m_matchSubdomains; }
     
-    static bool matchesPatterns(const KURL&, const Vector<String>&);
+    static bool matchesPatterns(const KURL&, const Vector<String>* whitelist, const Vector<String>* blacklist);
 
 private:
     bool parse(const String& pattern);
diff --git a/src/3rdparty/webkit/WebCore/page/UserScript.h b/src/3rdparty/webkit/WebCore/page/UserScript.h
index 51031ab..dbbb879 100644
--- a/src/3rdparty/webkit/WebCore/page/UserScript.h
+++ b/src/3rdparty/webkit/WebCore/page/UserScript.h
@@ -29,6 +29,7 @@
 #include "KURL.h"
 #include "UserScriptTypes.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -36,11 +37,12 @@ namespace WebCore {
 class UserScript {
 public:
     UserScript(const String& source, const KURL& url,
-               const Vector<String>& patterns, unsigned worldID,
-               UserScriptInjectionTime injectionTime)
+               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+               unsigned worldID, UserScriptInjectionTime injectionTime)
         : m_source(source)
         , m_url(url)
-        , m_patterns(patterns)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
         , m_worldID(worldID)
         , m_injectionTime(injectionTime)
     {
@@ -48,14 +50,16 @@ public:
 
     const String& source() const { return m_source; }
     const KURL& url() const { return m_url; }
-    const Vector<String>& patterns() const { return m_patterns; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
     unsigned worldID() const { return m_worldID; }
     UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
     
 private:
     String m_source;
     KURL m_url;
-    Vector<String> m_patterns;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
     unsigned m_worldID;
     UserScriptInjectionTime m_injectionTime;
 };
diff --git a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
index 5ae95c3..56bec40 100644
--- a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
@@ -29,6 +29,7 @@
 #include "KURL.h"
 #include "UserStyleSheetTypes.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -36,23 +37,27 @@ namespace WebCore {
 class UserStyleSheet {
 public:
     UserStyleSheet(const String& source, const KURL& url,
-               const Vector<String>& patterns, unsigned worldID)
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                   unsigned worldID)
         : m_source(source)
         , m_url(url)
-        , m_patterns(patterns)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
         , m_worldID(worldID)
     {
     }
 
     const String& source() const { return m_source; }
     const KURL& url() const { return m_url; }
-    const Vector<String>& patterns() const { return m_patterns; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
     unsigned worldID() const { return m_worldID; }
 
 private:
     String m_source;
     KURL m_url;
-    Vector<String> m_patterns;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
     unsigned m_worldID;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index 4fcc53c..890c3fa 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -58,15 +58,30 @@ static bool isNonCanonicalCharacter(UChar c)
     return (c == '\\' || c == '0' || c < ' ' || c >= 127);
 }
 
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
+static bool isIllegalURICharacter(UChar c)
 {
-    if (decodeEntities == m_decodeEntities && encoding == m_encoding && url == m_inputURL)
+    // The characters described in section 2.4.3 of RFC 2396 <http://www.faqs.org/rfcs/rfc2396.html> in addition to the 
+    // single quote character "'" are considered illegal URI characters. That is, the following characters cannot appear
+    // in a valid URI: ', ", <, >
+    //
+    // If the request does not contain these characters then we can assume that no inline scripts have been injected 
+    // into the response page, because it is impossible to write an inline script of the form <script>...</script>
+    // without "<", ">".
+    return (c == '\'' || c == '"' || c == '<' || c == '>');
+}
+
+String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                                            bool decodeURLEscapeSequencesTwice)
+{
+    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
+        && encoding == m_encoding && url == m_inputURL)
         return m_cachedCanonicalizedURL;
 
-    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities));
+    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities, decodeURLEscapeSequencesTwice));
     m_inputURL = url;
     m_encoding = encoding;
     m_decodeEntities = decodeEntities;
+    m_decodeURLEscapeSequencesTwice = decodeURLEscapeSequencesTwice;
     return m_cachedCanonicalizedURL;
 }
 
@@ -90,7 +105,7 @@ bool XSSAuditor::canEvaluate(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, false)) {
+    if (findInRequest(code, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -103,7 +118,7 @@ bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -116,7 +131,7 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -129,6 +144,16 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const Strin
     if (!isEnabled())
         return true;
 
+    // If the script is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // script. If the script has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL scriptURL(m_frame->document()->url(), url);
+    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+        return true;
+
     if (findInRequest(context + url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
@@ -170,7 +195,7 @@ String XSSAuditor::canonicalize(const String& string)
     return result.removeCharacters(&isNonCanonicalCharacter);
 }
 
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities)
+String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities, bool decodeURLEscapeSequencesTwice)
 {
     String result;
     String url = string;
@@ -181,6 +206,13 @@ String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding,
     String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
     if (!decodedResult.isEmpty())
         result = decodedResult;
+    if (decodeURLEscapeSequencesTwice) {
+        result = decodeURLEscapeSequences(result);
+        utf8Url = result.utf8();
+        decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
+        if (!decodedResult.isEmpty())
+            result = decodedResult;
+    }
     if (decodeEntities)
         result = decodeHTMLEntities(result);
     return result;
@@ -223,18 +255,20 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeEntities) const
+bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
+                               bool decodeURLEscapeSequencesTwice) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeEntities);
+        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
     if (!result)
-        result = findInRequest(m_frame, string, decodeEntities);
+        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
+                               bool decodeURLEscapeSequencesTwice) const
 {
     ASSERT(frame->document());
 
@@ -273,9 +307,14 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities);
+        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
+
+        if (allowRequestIfNoIllegalURICharacters && (!formDataObj || formDataObj->isEmpty()) 
+            && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
+            return false; // Injection is impossible because the request does not contain any illegal URI characters. 
+
         if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
-           return true;  // We've found the smoking gun.
+            return true;  // We've found the smoking gun.
     }
 
     if (formDataObj && !formDataObj->isEmpty()) {
@@ -285,7 +324,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities);
+            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
             if (decodedFormData.find(canonicalizedString, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index 58b2cc2..adfa5c7 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -102,25 +102,30 @@ namespace WebCore {
         class CachingURLCanonicalizer
         {
         public:
-            CachingURLCanonicalizer() : m_decodeEntities(false) { }
-            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+            CachingURLCanonicalizer() : m_decodeEntities(false), m_decodeURLEscapeSequencesTwice(false) { }
+            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                   bool decodeURLEscapeSequencesTwice);
 
         private:
             // The parameters we were called with last.
             String m_inputURL;
             TextEncoding m_encoding;
             bool m_decodeEntities;
+            bool m_decodeURLEscapeSequencesTwice;
 
             // The cached result.
             String m_cachedCanonicalizedURL;
         };
 
         static String canonicalize(const String&);
-        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                bool decodeURLEscapeSequencesTwice = false);
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(const String&, bool decodeEntities = true) const;
-        bool findInRequest(Frame*, const String&, bool decodeEntities = true) const;
+        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
+                           bool decodeURLEscapeSequencesTwice = false) const;
+        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
+                           bool decodeURLEscapeSequencesTwice = false) const;
 
         // The frame to audit.
         Frame* m_frame;
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index e54be8b..ec0e284 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -361,6 +361,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return true;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -373,6 +377,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -635,7 +643,7 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyOutlineColor, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor));
 
         // These are for shadows
-        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
+        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyWebkitBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
         gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyTextShadow, &RenderStyle::textShadow, &RenderStyle::setTextShadow));
 
 #if ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index 691932e..aa5de2c 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -55,7 +55,7 @@ AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     , m_lastStyleAvailableWaiter(0)
     , m_responseWaiters(0)
     , m_lastResponseWaiter(0)
-    , m_waitingForAResponse(false)
+    , m_waitingForResponse(false)
 {
 }
 
@@ -279,6 +279,19 @@ double AnimationControllerPrivate::beginAnimationUpdateTime()
     return m_beginAnimationUpdateTime;
 }
 
+void AnimationControllerPrivate::endAnimationUpdate()
+{
+    styleAvailable();
+    if (!m_waitingForResponse)
+        startTimeResponse(beginAnimationUpdateTime());
+}
+
+void AnimationControllerPrivate::receivedStartTimeResponse(double time)
+{
+    m_waitingForResponse = false;
+    startTimeResponse(time);
+}
+
 PassRefPtr<RenderStyle> AnimationControllerPrivate::getAnimatedStyleForRenderer(RenderObject* renderer)
 {
     if (!renderer)
@@ -378,7 +391,7 @@ void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* a
     ASSERT(!animation->next());
     
     if (willGetResponse)
-        m_waitingForAResponse = true;
+        m_waitingForResponse = true;
     
     if (m_responseWaiters)
         m_lastResponseWaiter->setNext(animation);
@@ -408,13 +421,13 @@ void AnimationControllerPrivate::removeFromStartTimeResponseWaitList(AnimationBa
     }
 }
 
-void AnimationControllerPrivate::startTimeResponse(double t)
+void AnimationControllerPrivate::startTimeResponse(double time)
 {
     // Go through list of waiters and send them on their way
     for (AnimationBase* animation = m_responseWaiters; animation; ) {
         AnimationBase* nextAnimation = animation->next();
         animation->setNext(0);
-        animation->onAnimationStartResponse(t);
+        animation->onAnimationStartResponse(time);
         animation = nextAnimation;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
index 359b9b5..7db3803 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationControllerPrivate.h
@@ -80,18 +80,8 @@ public:
 
     double beginAnimationUpdateTime();
     void setBeginAnimationUpdateTime(double t) { m_beginAnimationUpdateTime = t; }
-    void endAnimationUpdate()
-    {
-        styleAvailable();
-        if (!m_waitingForAResponse)
-            startTimeResponse(beginAnimationUpdateTime());
-    }
-    
-    void receivedStartTimeResponse(double t)
-    {
-        m_waitingForAResponse = false;
-        startTimeResponse(t);
-    }
+    void endAnimationUpdate();
+    void receivedStartTimeResponse(double);
     
     void addToStyleAvailableWaitList(AnimationBase*);
     void removeFromStyleAvailableWaitList(AnimationBase*);    
@@ -127,7 +117,7 @@ private:
     
     AnimationBase* m_responseWaiters;
     AnimationBase* m_lastResponseWaiter;
-    bool m_waitingForAResponse;
+    bool m_waitingForResponse;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
index 8e6349d..50fc781 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
@@ -142,10 +142,8 @@ void ImplicitAnimation::onAnimationEnd(double elapsedTime)
     if (keyframeAnim)
         keyframeAnim->setUnanimatedStyle(m_toStyle);
     
-    if (!sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime)) {
-        // We didn't dispatch an event, which would call endAnimation(), so we'll just call it here.
-        endAnimation(true);
-    }
+    sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime);
+    endAnimation(true);
 }
 
 bool ImplicitAnimation::sendTransitionEvent(const AtomicString& eventType, double elapsedTime)
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
index 39ae1e7..7e37e5f 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
@@ -244,10 +244,8 @@ void KeyframeAnimation::onAnimationIteration(double elapsedTime)
 
 void KeyframeAnimation::onAnimationEnd(double elapsedTime)
 {
-    if (!sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime)) {
-        // We didn't dispatch an event, which would call endAnimation(), so we'll just call it here.
-        endAnimation(true);
-    }
+    sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime);
+    endAnimation(true);
 }
 
 bool KeyframeAnimation::sendAnimationEvent(const AtomicString& eventType, double elapsedTime)
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index 21fa7df..ee6aa4e 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -361,10 +361,10 @@ void ContextMenu::populate()
                 appendItem(StopItem);
                 appendItem(ReloadItem);
 #else
-                if (loader->canGoBackOrForward(-1))
+                if (frame->page() && frame->page()->canGoBackOrForward(-1))
                     appendItem(BackItem);
 
-                if (loader->canGoBackOrForward(1))
+                if (frame->page() && frame->page()->canGoBackOrForward(1))
                     appendItem(ForwardItem);
 
                 // use isLoadingInAPISense rather than isLoading because Stop/Reload are
@@ -721,10 +721,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
-            shouldEnable = frame->loader()->canGoBackOrForward(-1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(-1);
             break;
         case ContextMenuItemTagGoForward:
-            shouldEnable = frame->loader()->canGoBackOrForward(1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(1);
             break;
         case ContextMenuItemTagStop:
             shouldEnable = frame->loader()->documentLoader()->isLoadingInAPISense();
diff --git a/src/3rdparty/webkit/WebCore/platform/Cookie.h b/src/3rdparty/webkit/WebCore/platform/Cookie.h
index 3e74ddc..0fe3851 100644
--- a/src/3rdparty/webkit/WebCore/platform/Cookie.h
+++ b/src/3rdparty/webkit/WebCore/platform/Cookie.h
@@ -27,6 +27,7 @@
 #define Cookie_h
 
 #include "PlatformString.h"
+#include "StringHash.h"
 
 namespace WebCore {
 
@@ -58,6 +59,24 @@ namespace WebCore {
         bool session;
     };
 
+    struct CookieHash {
+        static unsigned hash(Cookie key)
+        { 
+            return StringHash::hash(key.name) + StringHash::hash(key.domain) + StringHash::hash(key.path) + key.secure;
+        }
+
+        static bool equal(Cookie a, Cookie b)
+        {
+            return a.name == b.name && a.domain == b.domain && a.path == b.path && a.secure == b.secure;
+        }
+    };
+}
+
+namespace WTF {
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::Cookie> {
+        typedef WebCore::CookieHash Hash;
+    };
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
index 9ca626f..d02da6c 100644
--- a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.cpp
@@ -41,7 +41,7 @@ namespace WebCore {
 
 CrossThreadCopierBase<false, String>::Type CrossThreadCopierBase<false, String>::copy(const String& str)
 {
-    return str.copy();
+    return str.crossThreadString();
 }
 
 CrossThreadCopierBase<false, ResourceError>::Type CrossThreadCopierBase<false, ResourceError>::copy(const ResourceError& error)
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.cpp b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
index aa9c624..ffacc19 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
@@ -529,7 +529,7 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
 KURL KURL::copy() const
 {
     KURL result = *this;
-    result.m_string = result.m_string.copy();
+    result.m_string = result.m_string.crossThreadString();
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
index b323332..d0aae0c 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
@@ -106,7 +106,7 @@ static inline bool isUnicodeEncoding(const TextEncoding* encoding)
 static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char* str)
 {
     while (begin != end && *str) {
-        ASSERT(isASCIILower(*str));
+        ASSERT(toASCIILower(*str) == *str);
         if (toASCIILower(*begin++) != *str++)
             return false;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index d8c3318..ee8726a 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -751,6 +751,22 @@ void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& corn
     ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
+void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
+{
+    if (m_horizontalScrollbar)
+        m_horizontalScrollbar->paint(context, rect);
+    if (m_verticalScrollbar)
+        m_verticalScrollbar->paint(context, rect);
+
+    paintScrollCorner(context, scrollCornerRect());
+}
+
+void ScrollView::paintPanScrollIcon(GraphicsContext* context)
+{
+    DEFINE_STATIC_LOCAL(Image*, panScrollIcon, (Image::loadPlatformResource("panIcon").releaseRef()));
+    context->drawImage(panScrollIcon, m_panScrollIconPoint);
+}
+
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
 {
     if (platformWidget()) {
@@ -785,20 +801,15 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         scrollViewDirtyRect.intersect(frameRect());
         context->translate(x(), y());
         scrollViewDirtyRect.move(-x(), -y());
-        if (m_horizontalScrollbar)
-            m_horizontalScrollbar->paint(context, scrollViewDirtyRect);
-        if (m_verticalScrollbar)
-            m_verticalScrollbar->paint(context, scrollViewDirtyRect);
 
-        paintScrollCorner(context, scrollCornerRect());
+        paintScrollbars(context, scrollViewDirtyRect);
+
         context->restore();
     }
 
     // Paint the panScroll Icon
-    if (m_drawPanScrollIcon) {
-        DEFINE_STATIC_LOCAL(RefPtr<Image>, panScrollIcon, (Image::loadPlatformResource("panIcon")));
-        context->drawImage(panScrollIcon.get(), m_panScrollIconPoint);
-    }
+    if (m_drawPanScrollIcon)
+        paintPanScrollIcon(context);
 }
 
 bool ScrollView::isPointInScrollbarCorner(const IntPoint& windowPoint)
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index 8fcdf60..1950a54 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -207,6 +207,7 @@ public:
 
     // Widget override.  Handles painting of the contents of the view as well as the scrollbars.
     virtual void paint(GraphicsContext*, const IntRect&);
+    void paintScrollbars(GraphicsContext*, const IntRect&);
 
     // Widget overrides to ensure that our children's visibility status is kept up to date when we get shown and hidden.
     virtual void show();
@@ -217,6 +218,7 @@ public:
     static const int noPanScrollRadius = 15;
     void addPanScrollIcon(const IntPoint&);
     void removePanScrollIcon();
+    void paintPanScrollIcon(GraphicsContext*);
 
     virtual bool isPointInScrollbarCorner(const IntPoint&);
     virtual bool scrollbarCornerPresent() const;
@@ -234,7 +236,7 @@ protected:
     
     virtual void contentsResized() = 0;
     virtual void visibleContentsResized() = 0;
-    
+
     // These methods are used to create/destroy scrollbars.
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
diff --git a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
index 7171102..3fc5b0f 100644
--- a/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
+++ b/src/3rdparty/webkit/WebCore/platform/SuddenTermination.h
@@ -30,6 +30,9 @@
 
 namespace WebCore {
 
+    // Once disabled via one or more more calls to disableSuddenTermination(), fast shutdown
+    // is not valid until enableSuddenTermination() has been called an equal number of times.
+    // On Mac, these are thin wrappers around Mac OS X functions of the same name.
     void disableSuddenTermination();
     void enableSuddenTermination();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
index 3ab41dd..e132313 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
@@ -46,7 +46,7 @@ typedef unsigned ControlStates;
 // Must follow CSSValueKeywords.in order
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
-    ButtonBevelPart, DefaultButtonPart, ListboxPart, ListItemPart, 
+    ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
index 0f3f9aa..d712efb 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
@@ -141,6 +141,7 @@ public:
 #endif
 
 #if PLATFORM(WIN)
+    static PassRefPtr<BitmapImage> create(HBITMAP);
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
index a60af29..fc63db9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
@@ -29,6 +29,7 @@
 #include "FontRenderingMode.h"
 #include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
+#include "TextRenderingMode.h"
 
 namespace WebCore {
 
@@ -63,6 +64,7 @@ public:
         , m_renderingMode(NormalRenderingMode)
         , m_keywordSize(0)
         , m_fontSmoothing(AutoSmoothing)
+        , m_textRendering(AutoTextRendering)
     {
     }
 
@@ -87,6 +89,7 @@ public:
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
     unsigned keywordSize() const { return m_keywordSize; }
     FontSmoothingMode fontSmoothing() const { return static_cast<FontSmoothingMode>(m_fontSmoothing); }
+    TextRenderingMode textRenderingMode() const { return static_cast<TextRenderingMode>(m_textRendering); }
 
     FontTraitsMask traitsMask() const;
 
@@ -102,6 +105,7 @@ public:
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
     void setKeywordSize(unsigned s) { m_keywordSize = s; }
     void setFontSmoothing(FontSmoothingMode smoothing) { m_fontSmoothing = smoothing; }
+    void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -125,6 +129,7 @@ private:
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
 
     unsigned m_fontSmoothing : 2; // FontSmoothingMode
+    unsigned m_textRendering : 2; // TextRenderingMode
 };
 
 inline bool FontDescription::operator==(const FontDescription& other) const
@@ -140,7 +145,8 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_usePrinterFont == other.m_usePrinterFont
         && m_renderingMode == other.m_renderingMode
         && m_keywordSize == other.m_keywordSize
-        && m_fontSmoothing == other.m_fontSmoothing;
+        && m_fontSmoothing == other.m_fontSmoothing
+        && m_textRendering == other.m_textRendering;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
index b0e39db..5246593 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
@@ -251,6 +251,10 @@ bool Font::canUseGlyphCache(const TextRun& run) const
             return false;
     }
 
+    TextRenderingMode textMode = m_fontDescription.textRenderingMode();
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision)
+        return false;
+
     return true;
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
index e0d9294..c6bb20c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
@@ -297,6 +297,11 @@ namespace WebCore {
         void addPath(const Path&);
 
         void clip(const Path&);
+
+        // This clip function is used only by <canvas> code. It allows
+        // implementations to handle clipping on the canvas differently since
+        // the disipline is different.
+        void canvasClip(const Path&);
         void clipOut(const Path&);
 
         void scale(const FloatSize&);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
index edda215..67224e2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
@@ -45,6 +45,7 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
+    class CanvasActiveInfo;
     class CanvasArray;
     class CanvasBuffer;
     class CanvasUnsignedByteArray;
@@ -61,9 +62,15 @@ namespace WebCore {
     class HTMLVideoElement;
     class ImageData;
     class WebKitCSSMatrix;
-    
+
+    struct ActiveInfo {
+        String name;
+        unsigned type;
+        int size;
+    };
+
     // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(SKIA)
+#if PLATFORM(CHROMIUM)
     class GraphicsContext3DInternal;
 #endif
 
@@ -77,7 +84,7 @@ namespace WebCore {
 #if PLATFORM(MAC)
         PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
         Platform3DObject platformTexture() const { return m_texture; }
-#elif PLATFORM(SKIA)
+#elif PLATFORM(CHROMIUM)
         PlatformGraphicsContext3D platformGraphicsContext3D() const;
         Platform3DObject platformTexture() const;
 #else
@@ -141,6 +148,9 @@ namespace WebCore {
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
 
+        bool getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo&);
+
         int  getAttribLocation(CanvasProgram*, const String& name);
 
         bool getBoolean(unsigned long pname);
@@ -204,8 +214,7 @@ namespace WebCore {
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        // TBD
-        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
@@ -323,7 +332,7 @@ namespace WebCore {
 #endif        
 
         // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(SKIA)
+#if PLATFORM(CHROMIUM)
         friend class GraphicsContext3DInternal;
         OwnPtr<GraphicsContext3DInternal> m_internal;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
index b375bd3..d196a0c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -86,6 +86,16 @@ GraphicsLayer::~GraphicsLayer()
     removeFromParent();
 }
 
+bool GraphicsLayer::hasAncestor(GraphicsLayer* ancestor) const
+{
+    for (GraphicsLayer* curr = parent(); curr; curr = curr->parent()) {
+        if (curr == ancestor)
+            return true;
+    }
+    
+    return false;
+}
+
 void GraphicsLayer::addChild(GraphicsLayer* childLayer)
 {
     ASSERT(childLayer != this);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
index 2924073..e5b17a6 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
@@ -172,6 +172,9 @@ public:
     GraphicsLayer* parent() const { return m_parent; };
     void setParent(GraphicsLayer* layer) { m_parent = layer; } // Internal use only.
     
+    // Returns true if the layer has the given layer as an ancestor (excluding self).
+    bool hasAncestor(GraphicsLayer*) const;
+    
     const Vector<GraphicsLayer*>& children() const { return m_children; }
 
     // Add child layers. If the child is already parented, it will be removed from its old parent.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
index 799368b..bf7ae21 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
@@ -120,8 +120,6 @@ size_t ImageSource::frameCount() const
     return m_decoder ? m_decoder->frameCount() : 0;
 }
 
-#if !PLATFORM(QT)
-
 NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
 {
     if (!m_decoder)
@@ -180,6 +178,4 @@ bool ImageSource::frameIsCompleteAtIndex(size_t index)
     return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
 }
 
-#endif
-
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index 23410b2..3b32b65 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -62,10 +62,11 @@ public:
     virtual void load(const String&) { }
     virtual void cancelLoad() { }
     
+    virtual void prepareToPlay() { }
     virtual void play() { }
     virtual void pause() { }    
 
-    virtual bool supportsFullscreen() const { return false; }
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
 
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
@@ -104,8 +105,10 @@ public:
 
     virtual void paint(GraphicsContext*, const IntRect&) { }
 
+    virtual bool canLoadPoster() const { return false; }
+    virtual void setPoster(const String&) { }
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    virtual void setPoster(const String& /*url*/) { }
     virtual void deliverNotification(MediaPlayerProxyNotificationType) { }
     virtual void setMediaPlayerProxy(WebMediaPlayerProxy*) { }
 #endif
@@ -253,18 +256,26 @@ void MediaPlayer::load(const String& url, const ContentType& contentType)
         m_private.set(createNullMediaPlayer(this));
 }    
 
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+bool MediaPlayer::canLoadPoster() const
+{
+    return m_private->canLoadPoster();
+}
+    
 void MediaPlayer::setPoster(const String& url)
 {
     m_private->setPoster(url);
 }    
-#endif
 
 void MediaPlayer::cancelLoad()
 {
     m_private->cancelLoad();
 }    
 
+void MediaPlayer::prepareToPlay()
+{
+    m_private->prepareToPlay();
+}
+    
 void MediaPlayer::play()
 {
     m_private->play();
@@ -338,6 +349,11 @@ bool MediaPlayer::inMediaDocument()
     return document && document->isMediaDocument();
 }
 
+PlatformMedia MediaPlayer::platformMedia() const
+{
+    return m_private->platformMedia();
+}
+
 MediaPlayer::NetworkState MediaPlayer::networkState()
 {
     return m_private->networkState();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 4c5ee5b..4cc6476 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -38,8 +38,24 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
 
+#ifdef __OBJC__
+@class QTMovie;
+#else
+class QTMovie;
+#endif
+
 namespace WebCore {
 
+// Structure that will hold every native
+// types supported by the current media player.
+// We have to do that has multiple media players
+// backend can live at runtime.
+typedef struct PlatformMedia {
+    QTMovie* qtMovie;
+} PlatformMedia;
+
+static const PlatformMedia NoPlatformMedia = { 0 };
+
 class ContentType;
 class FrameView;
 class GraphicsContext;
@@ -110,6 +126,8 @@ public:
 
     bool supportsFullscreen() const;
     bool supportsSave() const;
+    PlatformMedia platformMedia() const;
+
     IntSize naturalSize();
     bool hasVideo() const;
     bool hasAudio() const;
@@ -127,6 +145,7 @@ public:
     bool visible() const;
     void setVisible(bool);
     
+    void prepareToPlay();
     void play();
     void pause();    
     
@@ -186,8 +205,10 @@ public:
 
     MediaPlayerClient* mediaPlayerClient() const { return m_mediaPlayerClient; }
 
+    bool canLoadPoster() const;
+    void setPoster(const String&);
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    void setPoster(const String& url);
     void deliverNotification(MediaPlayerProxyNotificationType notification);
     void setMediaPlayerProxy(WebMediaPlayerProxy* proxy);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
index 9cc89c5..f5687b3 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -43,6 +43,9 @@ public:
     virtual void load(const String& url) = 0;
     virtual void cancelLoad() = 0;
     
+    virtual void prepareToPlay() { }
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
+
     virtual void play() = 0;
     virtual void pause() = 0;    
 
@@ -93,8 +96,10 @@ public:
 
     virtual void setAutobuffer(bool) { };
 
+    virtual bool canLoadPoster() const { return false; }
+    virtual void setPoster(const String&) { }
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    virtual void setPoster(const String& url) = 0;
     virtual void deliverNotification(MediaPlayerProxyNotificationType) = 0;
     virtual void setMediaPlayerProxy(WebMediaPlayerProxy*) = 0;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
index d326658..387a5c7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
@@ -28,6 +28,7 @@
 #include "FontPlatformData.h"
 #include "GlyphPageTreeNode.h"
 #include "GlyphWidthMap.h"
+#include "TextRenderingMode.h"
 #include <wtf/OwnPtr.h>
 
 #if USE(ATSUI)
@@ -120,7 +121,7 @@ public:
 
 #if USE(CORE_TEXT)
     CTFontRef getCTFont() const;
-    CFDictionaryRef getCFStringAttributes() const;
+    CFDictionaryRef getCFStringAttributes(TextRenderingMode) const;
 #endif
 
 #if USE(ATSUI)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/TextRenderingMode.h b/src/3rdparty/webkit/WebCore/platform/graphics/TextRenderingMode.h
new file mode 100644
index 0000000..4f817a4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/TextRenderingMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextRenderingMode_h
+#define TextRenderingMode_h
+
+namespace WebCore {
+
+    enum TextRenderingMode { AutoTextRendering, OptimizeSpeed, OptimizeLegibility, GeometricPrecision };
+    
+} // namespace WebCore
+
+#endif // TextRenderingMode_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
index f452a2d..1b41165 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -133,8 +133,8 @@ void FEComposite::apply(Filter* filter)
     FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
     switch (m_type) {
     case FECOMPOSITE_OPERATOR_OVER:
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
         filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
         break;
     case FECOMPOSITE_OPERATOR_IN:
         filterContext->save();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
new file mode 100644
index 0000000..a62dfdc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -0,0 +1,139 @@
+/*
+    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+                  2004, 2005 Rob Buis <buis@kde.org>
+                  2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "FEGaussianBlur.h"
+
+#include "CanvasPixelArray.h"
+#include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
+
+namespace WebCore {
+
+FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
+    : FilterEffect()
+    , m_in(in)
+    , m_x(x)
+    , m_y(y)
+{
+}
+
+PassRefPtr<FEGaussianBlur> FEGaussianBlur::create(FilterEffect* in, const float& x, const float& y)
+{
+    return adoptRef(new FEGaussianBlur(in, x, y));
+}
+
+float FEGaussianBlur::stdDeviationX() const
+{
+    return m_x;
+}
+
+void FEGaussianBlur::setStdDeviationX(float x)
+{
+    m_x = x;
+}
+
+float FEGaussianBlur::stdDeviationY() const
+{
+    return m_y;
+}
+
+void FEGaussianBlur::setStdDeviationY(float y)
+{
+    m_y = y;
+}
+
+void boxBlur(CanvasPixelArray*& srcPixelArray, CanvasPixelArray*& dstPixelArray,
+                 unsigned dx, int stride, int strideLine, int effectWidth, int effectHeight, bool alphaImage)
+{
+    int dxLeft = static_cast<int>(floor(dx / 2));
+    int dxRight = dx - dxLeft;
+
+    for (int y = 0; y < effectHeight; ++y) {
+        int line = y * strideLine;
+        for (int channel = 3; channel >= 0; --channel) {
+            int sum = 0;
+            // Fill the kernel
+            int maxKernelSize = std::min(dxRight, effectWidth);
+            for (int i = 0; i < maxKernelSize; ++i)
+                sum += srcPixelArray->get(line + i * stride + channel);
+
+            // Blurring
+            for (int x = 0; x < effectWidth; ++x) {
+                int pixelByteOffset = line + x * stride + channel;
+                dstPixelArray->set(pixelByteOffset, static_cast<unsigned char>(sum / dx));
+                if (x >= dxLeft)
+                    sum -= srcPixelArray->get(pixelByteOffset - dxLeft * stride);
+                if (x + dxRight < effectWidth)
+                    sum += srcPixelArray->get(pixelByteOffset + dxRight * stride);
+            }
+            if (alphaImage) // Source image is black, it just has different alpha values
+                break;
+        }
+    }
+}
+
+void FEGaussianBlur::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    setIsAlphaImage(m_in->isAlphaImage());
+
+    if (m_x == 0 || m_y == 0)
+        return;
+
+    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * M_PI) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * M_PI) / 4.f + 0.5f));
+
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
+    CanvasPixelArray* srcPixelArray(srcImageData->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> tmpImageData = ImageData::create(imageRect.width(), imageRect.height());
+    CanvasPixelArray* tmpPixelArray(tmpImageData->data());
+
+    int stride = 4 * imageRect.width();
+    for (int i = 0; i < 3; ++i) {
+        boxBlur(srcPixelArray, tmpPixelArray, sdx, 4, stride, imageRect.width(), imageRect.height(), isAlphaImage());
+        boxBlur(tmpPixelArray, srcPixelArray, sdy, stride, 4, imageRect.height(), imageRect.width(), isAlphaImage());
+    }
+
+    resultImage()->putPremultipliedImageData(srcImageData.get(), imageRect, IntPoint());
+}
+
+void FEGaussianBlur::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.h
index 69f1cc5..ecdb9e3 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEGaussianBlur.h
@@ -19,10 +19,10 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef SVGFEGaussianBlur_h
-#define SVGFEGaussianBlur_h
+#ifndef FEGaussianBlur_h
+#define FEGaussianBlur_h
 
-#if ENABLE(SVG) && ENABLE(FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 #include "Filter.h"
 
@@ -41,7 +41,6 @@ namespace WebCore {
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
         void dump();
-        TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
         FEGaussianBlur(FilterEffect*, const float&, const float&);
@@ -53,6 +52,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(FILTERS)
+#endif // ENABLE(FILTERS)
 
-#endif // SVGFEGaussianBlur_h
+#endif // FEGaussianBlur_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
index 5818e50..68900b5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -25,14 +25,11 @@
 namespace WebCore {
 
 FilterEffect::FilterEffect()
-    : m_xBBoxMode(false)
-    , m_yBBoxMode(false)
-    , m_widthBBoxMode(false)
-    , m_heightBBoxMode(false)
-    , m_hasX(false)
+    : m_hasX(false)
     , m_hasY(false)
     , m_hasWidth(false)
     , m_hasHeight(false)
+    , m_alphaImage(false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
index e2b8a0e..b30e513 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
@@ -38,18 +38,6 @@ namespace WebCore {
     public:
         virtual ~FilterEffect();
 
-        bool xBoundingBoxMode() const { return m_xBBoxMode; }
-        void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-        bool yBoundingBoxMode() const { return m_yBBoxMode; }
-        void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
-        bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
-        void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
-
-        bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
-        void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
-
         void setUnionOfChildEffectSubregions(const FloatRect& uniteRect) { m_unionOfChildEffectSubregions = uniteRect; }
         FloatRect unionOfChildEffectSubregions() const { return m_unionOfChildEffectSubregions; }
 
@@ -79,6 +67,10 @@ namespace WebCore {
         FloatRect calculateDrawingRect(const FloatRect&);
         IntRect calculateDrawingIntRect(const FloatRect&);
 
+        // black image with different alpha values
+        bool isAlphaImage() { return m_alphaImage; }
+        void setIsAlphaImage(bool alphaImage) { m_alphaImage = alphaImage; }
+
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return filter->filterRegion(); }
         virtual FloatRect calculateEffectRect(Filter*);
         virtual void apply(Filter*) = 0;
@@ -102,6 +94,8 @@ namespace WebCore {
         bool m_hasWidth : 1;
         bool m_hasHeight : 1;
 
+        bool m_alphaImage;
+
         FloatRect m_subRegion;
         FloatRect m_unionOfChildEffectSubregions;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 646a57b..1b6309b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -22,6 +22,7 @@
 #if ENABLE(FILTERS)
 #include "SourceAlpha.h"
 
+#include "Color.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "Filter.h"
@@ -41,8 +42,30 @@ const AtomicString& SourceAlpha::effectName()
     return s_effectName;
 }
 
-void SourceAlpha::apply(Filter*)
+FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
 {
+    FloatRect clippedSourceRect = filter->sourceImageRect();
+    if (filter->sourceImageRect().x() < filter->filterRegion().x())
+        clippedSourceRect.setX(filter->filterRegion().x());
+    if (filter->sourceImageRect().y() < filter->filterRegion().y())
+        clippedSourceRect.setY(filter->filterRegion().y());
+    setSubRegion(clippedSourceRect);
+    return filter->filterRegion();
+}
+
+void SourceAlpha::apply(Filter* filter)
+{
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    setIsAlphaImage(true);
+
+    FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
+    filterContext->save();
+    filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
+    filterContext->fillRect(imageRect, Color::black);
+    filterContext->restore();
 }
 
 void SourceAlpha::dump()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
index 5341562..172d05a 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -35,7 +35,7 @@ namespace WebCore {
         static const AtomicString& effectName();
 
         virtual bool isSourceInput() { return true; }
-        virtual FloatRect calculateEffectRect(Filter* filter) { return filter->sourceImageRect(); }
+        virtual FloatRect calculateEffectRect(Filter*);
         void apply(Filter*);
         void dump();
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp
index 5d16740..151766a 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ColorQt.cpp
@@ -40,7 +40,10 @@ Color::Color(const QColor& c)
 
 Color::operator QColor() const
 {
-    return QColor(red(), green(), blue(), alpha());
+    if (m_valid)
+        return QColor(red(), green(), blue(), alpha());
+    else
+        return QColor();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 094054b..57a481a 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -422,7 +422,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         IntRect shadowRect = rect;
         shadowRect.move(shadowSize.width(), shadowSize.height());
         shadowRect.inflate(static_cast<int>(p->pen().widthF()));
-        p->fillRect(shadowRect, shadowColor);
+        p->fillRect(shadowRect, QColor(shadowColor));
     }
 
     p->drawRect(rect);
@@ -482,11 +482,11 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
         if (isVerticalLine) {
-            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), color);
-            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), color);
+            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), QColor(color));
+            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), QColor(color));
         } else {
-            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), color);
-            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), color);
+            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), QColor(color));
+            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), QColor(color));
         }
 
         // Example: 80 pixels with a width of 30 pixels.
@@ -718,7 +718,7 @@ static inline void drawBorderlessRectShadow(GraphicsContext* context, QPainter*
     if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
         FloatRect shadowRect(rect);
         shadowRect.move(shadowSize.width(), shadowSize.height());
-        p->fillRect(shadowRect, shadowColor);
+        p->fillRect(shadowRect, QColor(shadowColor));
     }
 }
 
@@ -1053,20 +1053,29 @@ void GraphicsContext::clip(const Path& path)
     m_data->p()->setClipPath(*path.platformPath(), Qt::IntersectClip);
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
         return;
 
     QPainter* p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath clippedOut = *path.platformPath();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addPath(clippedOut);
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addPath(clippedOut);
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        newClip.addRect(p->window());
+        newClip.addPath(clippedOut & newClip);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::translate(float x, float y)
@@ -1125,13 +1134,20 @@ void GraphicsContext::clipOut(const IntRect& rect)
         return;
 
     QPainter* p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addRect(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addRect(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
@@ -1140,13 +1156,20 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
         return;
 
     QPainter* p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addEllipse(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addEllipse(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addEllipse(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 8851984..f8403b7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -35,11 +35,6 @@
 #include <QtGui/QImageReader>
 #include <qdebug.h>
 
-namespace {
-    const  QImage::Format DesiredFormat = QImage::Format_ARGB32;
-    const  bool debugImageDecoderQt = false;
-}
-
 namespace WebCore {
 
 ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
@@ -48,291 +43,205 @@ ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
     if (data.size() < 4)
         return 0;
 
-    QByteArray bytes = QByteArray::fromRawData(data.data(), data.size());
-    QBuffer buffer(&bytes);
-    if (!buffer.open(QBuffer::ReadOnly))
-        return 0;
-
-    QString imageFormat = QString::fromLatin1(QImageReader::imageFormat(&buffer).toLower());
-    if (imageFormat.isEmpty())
-        return 0; // Image format not supported
-
-    return new ImageDecoderQt(imageFormat);
+    return new ImageDecoderQt;
 }
 
-ImageDecoderQt::ImageData::ImageData(const QImage& image, ImageState imageState, int duration) :
-    m_image(image), m_imageState(imageState), m_duration(duration)
+ImageDecoderQt::ImageDecoderQt()
+    :  m_buffer(0)
+    , m_reader(0)
+    , m_repetitionCount(cAnimationNone)
 {
 }
 
-// Context, maintains IODevice on a data buffer.
-class ImageDecoderQt::ReadContext {
-public:
-
-    enum LoadMode {
-        // Load images incrementally. This is still experimental and
-        // will cause the image plugins to report errors.
-        // Also note that as of Qt 4.2.2, the JPEG loader does not return error codes
-        // on "preliminary end of data".
-        LoadIncrementally,
-            // Load images only if  all data have been received
-            LoadComplete };
-
-    ReadContext(SharedBuffer* data, LoadMode loadMode, ImageList &target);
-
-    enum ReadResult { ReadEOF, ReadFailed, ReadPartial, ReadComplete };
-
-    // Append data and read out all images. Returns the result
-    // of the last read operation, so, even if  ReadPartial is returned,
-    // a few images might have been read.
-    ReadResult read(bool allDataReceived);
-
-    QImageReader *reader() { return &m_reader; }
-
-private:
-    enum IncrementalReadResult { IncrementalReadFailed, IncrementalReadPartial, IncrementalReadComplete };
-    // Incrementally read an image
-    IncrementalReadResult readImageLines(ImageData &);
-
-    const LoadMode m_loadMode;
+ImageDecoderQt::~ImageDecoderQt()
+{
+    delete m_reader;
+    delete m_buffer;
+}
 
-    QByteArray m_data;
-    QBuffer m_buffer;
-    QImageReader m_reader;
+void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
+{
+    if (m_failed)
+        return;
 
-    ImageList &m_target;
+    // No progressive loading possible
+    if (!allDataReceived)
+        return;
 
-    // Detected data format of the stream
-    enum QImage::Format m_dataFormat;
-    QSize m_size;
+    // Cache our own new data.
+    ImageDecoder::setData(data, allDataReceived);
 
-};
+    // We expect to be only called once with allDataReceived
+    ASSERT(!m_buffer);
+    ASSERT(!m_reader);
 
-ImageDecoderQt::ReadContext::ReadContext(SharedBuffer* data, LoadMode loadMode, ImageList &target)
-    : m_loadMode(loadMode)
-    , m_data(data->data(), data->size())
-    , m_buffer(&m_data)
-    , m_reader(&m_buffer)
-    , m_target(target)
-    , m_dataFormat(QImage::Format_Invalid)
-{
-    m_buffer.open(QIODevice::ReadOnly);
+    // Attempt to load the data
+    QByteArray imageData = QByteArray::fromRawData(m_data->data(), m_data->size());
+    m_buffer = new QBuffer;
+    m_buffer->setData(imageData);
+    m_buffer->open(QBuffer::ReadOnly);
+    m_reader = new QImageReader(m_buffer, m_format);
 }
 
-
-ImageDecoderQt::ReadContext::ReadResult
-        ImageDecoderQt::ReadContext::read(bool allDataReceived)
+bool ImageDecoderQt::isSizeAvailable()
 {
-    // Complete mode: Read only all all data received
-    if (m_loadMode == LoadComplete && !allDataReceived)
-        return ReadPartial;
-
-    // Attempt to read out all images
-    while (true) {
-        if (m_target.empty() || m_target.back().m_imageState == ImageComplete) {
-            // Start a new image.
-            if (!m_reader.canRead())
-                return ReadEOF;
-
-            // Attempt to construct an empty image of the matching size and format
-            // for efficient reading
-            QImage newImage = m_dataFormat != QImage::Format_Invalid  ?
-                          QImage(m_size, m_dataFormat) : QImage();
-            m_target.push_back(ImageData(newImage));
-        }
+    if (!ImageDecoder::isSizeAvailable() && m_reader)
+        internalDecodeSize();
 
-        // read chunks
-        switch (readImageLines(m_target.back())) {
-        case IncrementalReadFailed:
-            m_target.pop_back();
-            return ReadFailed;
-        case IncrementalReadPartial:
-            return ReadPartial;
-        case IncrementalReadComplete:
-            m_target.back().m_imageState = ImageComplete;
-            //store for next
-            m_dataFormat = m_target.back().m_image.format();
-            m_size = m_target.back().m_image.size();
-            const bool supportsAnimation = m_reader.supportsAnimation();
-
-            if (debugImageDecoderQt)
-                qDebug() << "readImage(): #" << m_target.size() << " complete, " << m_size
-                    << " format " << m_dataFormat <<  " supportsAnimation=" <<  supportsAnimation;
-            // No point in readinfg further
-            if (!supportsAnimation)
-                return ReadComplete;
-
-            break;
-        }
-    }
-    return ReadComplete;
+    return ImageDecoder::isSizeAvailable();
 }
 
-
-
-ImageDecoderQt::ReadContext::IncrementalReadResult
-        ImageDecoderQt::ReadContext::readImageLines(ImageData &imageData)
+size_t ImageDecoderQt::frameCount()
 {
-    // TODO: Implement incremental reading here,
-    // set state to reflect complete header, etc.
-    // For now, we read the whole image.
-
-    const qint64 startPos = m_buffer.pos();
-    // Oops, failed. Rewind.
-    if (!m_reader.read(&imageData.m_image)) {
-        m_buffer.seek(startPos);
-        const bool gotHeader = imageData.m_image.size().width();
-
-        if (debugImageDecoderQt)
-            qDebug() << "readImageLines(): read() failed: " << m_reader.errorString()
-                << " got header=" << gotHeader;
-        // [Experimental] Did we manage to read the header?
-        if (gotHeader) {
-            imageData.m_imageState = ImageHeaderValid;
-            return IncrementalReadPartial;
+    if (m_frameBufferCache.isEmpty() && m_reader) {
+        if (m_reader->supportsAnimation()) {
+            int imageCount = m_reader->imageCount();
+
+            // Fixup for Qt decoders... imageCount() is wrong
+            // and jumpToNextImage does not work either... so
+            // we will have to parse everything...
+            if (imageCount == 0)
+                forceLoadEverything();
+            else
+                m_frameBufferCache.resize(imageCount);
+        } else {
+            m_frameBufferCache.resize(1);
         }
-        return IncrementalReadFailed;
     }
-    imageData.m_duration = m_reader.nextImageDelay();
-    return IncrementalReadComplete;
-}
 
-ImageDecoderQt::ImageDecoderQt(const QString& imageFormat)
-    : m_hasAlphaChannel(false)
-    , m_imageFormat(imageFormat)
-{
+    return m_frameBufferCache.size();
 }
 
-ImageDecoderQt::~ImageDecoderQt()
+int ImageDecoderQt::repetitionCount() const
 {
-}
+    if (m_reader && m_reader->supportsAnimation())
+        m_repetitionCount = qMax(0, m_reader->loopCount());
 
-bool ImageDecoderQt::hasFirstImageHeader() const
-{
-    return  !m_imageList.empty() && m_imageList[0].m_imageState >= ImageHeaderValid;
+    return m_repetitionCount;
 }
 
-void ImageDecoderQt::reset()
+String ImageDecoderQt::filenameExtension() const
 {
-    m_hasAlphaChannel = false;
-    m_failed = false;
-    m_imageList.clear();
-    m_pixmapCache.clear();
-    m_loopCount = cAnimationNone;
-}
+    return String(m_format.constData(), m_format.length());
+};
 
-void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
+RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
 {
-    reset();
-    ReadContext readContext(data, ReadContext::LoadComplete, m_imageList);
-
-    if (debugImageDecoderQt)
-        qDebug() << " setData " << data->size() << " image bytes, complete=" << allDataReceived;
-
-    const  ReadContext::ReadResult readResult =  readContext.read(allDataReceived);
-
-    if (hasFirstImageHeader())
-        m_hasAlphaChannel = m_imageList[0].m_image.hasAlphaChannel();
-
-    if (debugImageDecoderQt)
-        qDebug()  << " read returns " << readResult;
-
-    switch (readResult) {
-    case ReadContext::ReadFailed:
-        m_failed = true;
-        break;
-    case ReadContext::ReadEOF:
-    case ReadContext::ReadPartial:
-    case ReadContext::ReadComplete:
-        // Did we read anything - try to set the size.
-        if (hasFirstImageHeader()) {
-            QSize imgSize = m_imageList[0].m_image.size();
-            setSize(imgSize.width(), imgSize.height());
-
-            if (readContext.reader()->supportsAnimation()) {
-                if (readContext.reader()->loopCount() != -1)
-                    m_loopCount = readContext.reader()->loopCount();
-                else
-                    m_loopCount = 0; //loop forever
-            }
-        }
-        break;
+    // In case the ImageDecoderQt got recreated we don't know
+    // yet how many images we are going to have and need to
+    // find that out now.
+    int count = m_frameBufferCache.size();
+    if (!m_failed && count == 0) {
+        internalDecodeSize();
+        count = frameCount();
     }
-}
 
+    if (index >= static_cast<size_t>(count))
+        return 0;
 
-bool ImageDecoderQt::isSizeAvailable()
-{
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::isSizeAvailable() returns" << ImageDecoder::isSizeAvailable();
-    return ImageDecoder::isSizeAvailable();
+    RGBA32Buffer& frame = m_frameBufferCache[index];
+    if (frame.status() != RGBA32Buffer::FrameComplete && m_reader)
+        internalReadImage(index);
+    return &frame;
 }
 
-size_t ImageDecoderQt::frameCount() const
+void ImageDecoderQt::clearFrameBufferCache(size_t index)
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::frameCount() returns" << m_imageList.size();
-    return m_imageList.size();
-}
+    // Currently QImageReader will be asked to read everything. This
+    // might change when we read gif images on demand. For now we
+    // can have a rather simple implementation.
+    if (index > m_frameBufferCache.size())
+        return;
 
-int ImageDecoderQt::repetitionCount() const
-{
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::repetitionCount() returns" << m_loopCount;
-    return m_loopCount;
+    for (size_t i = 0; i < index; ++index)
+        m_frameBufferCache[index].clear();
 }
 
-bool ImageDecoderQt::supportsAlpha() const
+void ImageDecoderQt::internalDecodeSize()
 {
-    return m_hasAlphaChannel;
+    ASSERT(m_reader);
+
+    // If we have a QSize() something failed
+    QSize size = m_reader->size();
+    if (size.isEmpty())
+        return failRead();
+
+    m_format = m_reader->format();
+    setSize(size.width(), size.height());
 }
 
-int ImageDecoderQt::duration(size_t index) const
+void ImageDecoderQt::internalReadImage(size_t frameIndex)
 {
-    if (index >= static_cast<size_t>(m_imageList.size()))
-        return 0;
-    return  m_imageList[index].m_duration;
+    ASSERT(m_reader);
+
+    if (m_reader->supportsAnimation())
+        m_reader->jumpToImage(frameIndex);
+    else if (frameIndex != 0)
+        return failRead();
+
+    internalHandleCurrentImage(frameIndex);
+
+    // Attempt to return some memory
+    for (int i = 0; i < m_frameBufferCache.size(); ++i)
+        if (m_frameBufferCache[i].status() != RGBA32Buffer::FrameComplete)
+            return;
+
+    delete m_reader;
+    delete m_buffer;
+    m_buffer = 0;
+    m_reader = 0;
 }
 
-String ImageDecoderQt::filenameExtension() const
+void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
-    if (debugImageDecoderQt)
-           qDebug() << " ImageDecoderQt::filenameExtension() returns" << m_imageFormat;
-    return m_imageFormat;
-};
+    // Now get the QImage from Qt and place it in the RGBA32Buffer
+    QImage img;
+    if (!m_reader->read(&img))
+        return failRead();
 
-RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t)
-{
-    Q_ASSERT("use imageAtIndex instead");
-    return 0;
+    // now into the RGBA32Buffer - even if the image is not
+    QSize imageSize = img.size();
+    RGBA32Buffer* const buffer = &m_frameBufferCache[frameIndex];
+    buffer->setRect(m_reader->currentImageRect());
+    buffer->setStatus(RGBA32Buffer::FrameComplete);
+    buffer->setDuration(m_reader->nextImageDelay());
+    buffer->setDecodedImage(img);
 }
 
-QPixmap* ImageDecoderQt::imageAtIndex(size_t index) const
-{
-    if (debugImageDecoderQt)
-        qDebug() << "ImageDecoderQt::imageAtIndex(" << index << ')';
+// The QImageIOHandler is not able to tell us how many frames
+// we have and we need to parse every image. We do this by
+// increasing the m_frameBufferCache by one and try to parse
+// the image. We stop when QImage::read fails and then need
+// to resize the m_frameBufferCache to the final size and update
+// the m_failed. In case we failed to decode the first image
+// we want to keep m_failed set to true.
 
-    if (index >= static_cast<size_t>(m_imageList.size()))
-        return 0;
+// TODO: Do not increment the m_frameBufferCache.size() by one but more than one
+void ImageDecoderQt::forceLoadEverything()
+{
+    int imageCount = 0;
 
-    if (!m_pixmapCache.contains(index)) {
-        m_pixmapCache.insert(index,
-                             QPixmap::fromImage(m_imageList[index].m_image));
+    do {
+        m_frameBufferCache.resize(++imageCount);
+        internalHandleCurrentImage(imageCount - 1);
+    } while(!m_failed);
 
-        // store null image since the converted pixmap is already in pixmap cache
-        Q_ASSERT(m_imageList[index].m_imageState == ImageComplete);
-        m_imageList[index].m_image = QImage();
-    }
-    return  &m_pixmapCache[index];
+    // If we failed decoding the first image we actually
+    // have no images and need to keep m_failed set to
+    // true otherwise we want to reset it and forget about
+    // the last attempt to decode a image.
+    m_frameBufferCache.resize(imageCount - 1);
+    m_failed = imageCount == 1;
 }
 
-void ImageDecoderQt::clearFrame(size_t index)
+void ImageDecoderQt::failRead()
 {
-    if (m_imageList.size() < (int)index)
-        m_imageList[index].m_image = QImage();
-    m_pixmapCache.take(index);
+    setFailed();
+    delete m_reader;
+    delete m_buffer;
+    m_reader = 0;
+    m_buffer = 0;
 }
-
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
index 59751c5..d11b938 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -28,10 +28,11 @@
 #define ImageDecoderQt_h
 
 #include "ImageDecoder.h"
-#include <QtGui/QImage>
+#include <QtGui/QImageReader>
 #include <QtGui/QPixmap>
 #include <QtCore/QList>
 #include <QtCore/QHash>
+#include <QtCore/QBuffer>
 
 namespace WebCore {
 
@@ -39,51 +40,35 @@ namespace WebCore {
 class ImageDecoderQt : public ImageDecoder
 {
 public:
-    ImageDecoderQt(const QString& imageFormat);
+    ImageDecoderQt();
     ~ImageDecoderQt();
 
     virtual void setData(SharedBuffer* data, bool allDataReceived);
     virtual bool isSizeAvailable();
-    virtual size_t frameCount() const;
+    virtual size_t frameCount();
     virtual int repetitionCount() const;
     virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
-    QPixmap* imageAtIndex(size_t index) const;
-    virtual bool supportsAlpha() const;
-    int duration(size_t index) const;
     virtual String filenameExtension() const;
 
-    void clearFrame(size_t index);
+    virtual void clearFrameBufferCache(size_t clearBeforeFrame);
 
 private:
     ImageDecoderQt(const ImageDecoderQt&);
     ImageDecoderQt &operator=(const ImageDecoderQt&);
 
-    class ReadContext;
-    void reset();
-    bool hasFirstImageHeader() const;
-
-    enum ImageState {
-        // Started image reading
-        ImagePartial,
-            // Header (size / alpha) are known
-            ImageHeaderValid,
-            // Image is complete
-            ImageComplete };
-
-    struct ImageData {
-        ImageData(const QImage& image, ImageState imageState = ImagePartial, int duration=0);
-        QImage m_image;
-        ImageState m_imageState;
-        int m_duration;
-    };
-
-    bool m_hasAlphaChannel;
-    typedef QList<ImageData> ImageList;
-    mutable ImageList m_imageList;
-    mutable QHash<int, QPixmap> m_pixmapCache;
-    int m_loopCount;
-    QString m_imageFormat;
+private:
+    void internalDecodeSize();
+    void internalReadImage(size_t);
+    void internalHandleCurrentImage(size_t);
+    void forceLoadEverything();
+    void failRead();
+
+private:
+    QByteArray m_format;
+    QBuffer* m_buffer;
+    QImageReader* m_reader;
+    mutable int m_repetitionCount;
 };
 
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
index 5d40e26..da6ddac 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -76,6 +76,7 @@ bool FrameData::clear(bool clearMetadata)
         m_haveMetadata = false;
 
     if (m_frame) {
+        delete m_frame;
         m_frame = 0;
         return true;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
index 2df3df9..5692de7 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,6 +38,8 @@
 
 #if PLATFORM(SKIA)
 #include "NativeImageSkia.h"
+#elif PLATFORM(QT)
+#include <QImage>
 #endif
 
 namespace WebCore {
@@ -54,7 +57,7 @@ namespace WebCore {
             DisposeOverwriteBgcolor,   // Clear frame to transparent
             DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
         };
-#if PLATFORM(SKIA)
+#if PLATFORM(SKIA) || PLATFORM(QT)
         typedef uint32_t PixelData;
 #else
         typedef unsigned PixelData;
@@ -126,6 +129,11 @@ namespace WebCore {
             setRGBA(getAddr(x, y), r, g, b, a);
         }
 
+#if PLATFORM(QT)
+        void setDecodedImage(const QImage& image);
+        QImage decodedImage() const { return m_image; }
+#endif
+
     private:
         RGBA32Buffer& operator=(const RGBA32Buffer& other);
 
@@ -136,6 +144,8 @@ namespace WebCore {
         {
 #if PLATFORM(SKIA)
             return m_bitmap.getAddr32(x, y);
+#elif PLATFORM(QT)
+            return reinterpret_cast<QRgb*>(m_image.scanLine(y)) + x;
 #else
             return m_bytes.data() + (y * width()) + x;
 #endif
@@ -159,6 +169,10 @@ namespace WebCore {
 
 #if PLATFORM(SKIA)
         NativeImageSkia m_bitmap;
+#elif PLATFORM(QT)
+        mutable QImage m_image;
+        bool m_hasAlpha;
+        IntSize m_size;
 #else
         Vector<PixelData> m_bytes;
         IntSize m_size;       // The size of the buffer.  This should be the
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
new file mode 100644
index 0000000..da6ab38
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageDecoder.h"
+
+#include <QPixmap>
+#include <stdio.h>
+
+namespace WebCore {
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_status(FrameEmpty)
+    , m_hasAlpha(false)
+    , m_size()
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+}
+
+// The image must not have format 8888 pre multiplied...
+void RGBA32Buffer::setDecodedImage(const QImage& image)
+{
+    m_image = image;
+    m_size = image.size();
+    m_hasAlpha = image.hasAlphaChannel();
+}
+
+void RGBA32Buffer::clear()
+{
+    m_image = QImage();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_image.fill(0);
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_image = other.m_image;
+    m_size = other.m_size;
+    m_hasAlpha = other.m_hasAlpha;
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // This function should only be called once, it will leak memory
+    // otherwise.
+    ASSERT(width() == 0 && height() == 0);
+
+    m_size = IntSize(newWidth, newHeight);
+    m_image = QImage(newWidth, newHeight, QImage::Format_ARGB32_Premultiplied);
+    if (m_image.isNull()) {
+        // Allocation failure, maybe the bitmap was too big.
+        setStatus(FrameComplete);
+        return false;
+    }
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+QPixmap* RGBA32Buffer::asNewNativeImage() const
+{
+    QPixmap pix = QPixmap::fromImage(m_image);
+    m_image = QImage();
+
+    return new QPixmap(pix);
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index 78fb659..f4321ad 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -107,11 +107,15 @@ static String utiTypeFromCocoaType(NSString *type)
 static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([cocoaType isEqualToString:NSStringPboardType])
+    if ([cocoaType isEqualToString:NSStringPboardType]) {
         resultTypes.add("text/plain");
-    else if ([cocoaType isEqualToString:NSURLPboardType])
+        return;
+    }
+    if ([cocoaType isEqualToString:NSURLPboardType]) {
         resultTypes.add("text/uri-list");
-    else if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+        return;
+    }
+    if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
         // If file list is empty, add nothing.
         // Note that there is a chance that the file list count could have changed since we grabbed the types array.
         // However, this is not really an issue for us doing a sanity check here.
@@ -122,12 +126,15 @@ static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSSt
             resultTypes.add("text/uri-list");
             resultTypes.add("Files");
         }
-    } else if (String utiType = utiTypeFromCocoaType(cocoaType))
+        return;
+    }
+    String utiType = utiTypeFromCocoaType(cocoaType);
+    if (!utiType.isEmpty()) {
         resultTypes.add(utiType);
-    else {
-        // No mapping, just pass the whole string though
-        resultTypes.add(cocoaType);
+        return;
     }
+    // No mapping, just pass the whole string though
+    resultTypes.add(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
index e7e12ac..fd2f944 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ThemeMac.mm
@@ -311,6 +311,14 @@ static const IntSize* buttonSizes()
     return sizes;
 }
 
+#if ENABLE(DATALIST)
+static const IntSize* listButtonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(21, 21), IntSize(19, 18), IntSize(17, 16) };
+    return sizes;
+}
+#endif
+
 static const int* buttonMargins(NSControlSize controlSize)
 {
     static const int margins[3][4] =
@@ -333,6 +341,13 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
     }
 
     // Set the control size based off the rectangle we're painting into.
+    const IntSize* sizes = buttonSizes();
+#if ENABLE(DATALIST)
+    if (part == ListButtonPart) {
+        [buttonCell setBezelStyle:NSRoundedDisclosureBezelStyle];
+        sizes = listButtonSizes();
+    } else
+#endif
     if (part == SquareButtonPart || zoomedRect.height() > buttonSizes()[NSRegularControlSize].height() * zoomFactor) {
         // Use the square button
         if ([buttonCell bezelStyle] != NSShadowlessSquareBezelStyle)
@@ -362,7 +377,11 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     LocalCurrentGraphicsContext localContext(context);
 
     NSControlSize controlSize = [buttonCell controlSize];
+#if ENABLE(DATALIST)
+    IntSize zoomedSize = (part == ListButtonPart ? listButtonSizes() : buttonSizes())[controlSize];
+#else
     IntSize zoomedSize = buttonSizes()[controlSize];
+#endif
     zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
     zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
     IntRect inflatedRect = zoomedRect;
@@ -442,6 +461,10 @@ LengthSize ThemeMac::controlSize(ControlPart part, const Font& font, const Lengt
         case PushButtonPart:
             // Height is reset to auto so that specified heights can be ignored.
             return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, buttonSizes());
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, listButtonSizes());
+#endif
         default:
             return zoomedSize;
     }
@@ -453,6 +476,7 @@ LengthSize ThemeMac::minimumControlSize(ControlPart part, const Font& font, floa
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthSize(Length(0, Fixed), Length(static_cast<int>(15 * zoomFactor), Fixed));
         default:
             return Theme::minimumControlSize(part, font, zoomFactor);
@@ -465,6 +489,7 @@ LengthBox ThemeMac::controlBorder(ControlPart part, const Font& font, const Leng
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthBox(0, zoomedBox.right().value(), 0, zoomedBox.left().value());
         default:
             return Theme::controlBorder(part, font, zoomedBox, zoomFactor);
@@ -548,6 +573,7 @@ void ThemeMac::paint(ControlPart part, ControlStates states, GraphicsContext* co
         case DefaultButtonPart:
         case ButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
             paintButton(part, states, context, zoomedRect, zoomFactor, scrollView);
             break;
         default:
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
index 407ed5b..ec78372 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
@@ -43,13 +43,19 @@ static ProtectionSpaceToCredentialMap& protectionSpaceToCredentialMap()
     return map;
 }
 
-typedef HashMap<String, HashMap<String, Credential> > OriginToDefaultBasicCredentialMap;
-static OriginToDefaultBasicCredentialMap& originToDefaultBasicCredentialMap()
+static HashSet<String>& originsWithCredentials()
 {
-    DEFINE_STATIC_LOCAL(OriginToDefaultBasicCredentialMap, map, ());
+    DEFINE_STATIC_LOCAL(HashSet<String>, set, ());
+    return set;
+}
+
+typedef HashMap<String, ProtectionSpace> PathToDefaultProtectionSpaceMap;
+static PathToDefaultProtectionSpaceMap& pathToDefaultProtectionSpaceMap()
+{
+    DEFINE_STATIC_LOCAL(PathToDefaultProtectionSpaceMap, map, ());
     return map;
 }
-    
+
 static String originStringFromURL(const KURL& url)
 {
     if (url.port())
@@ -58,32 +64,37 @@ static String originStringFromURL(const KURL& url)
     return url.protocol() + "://" + url.host() + "/";
 }
 
+static String protectionSpaceMapKeyFromURL(const KURL& url)
+{
+    ASSERT(url.isValid());
+
+    // Remove the last path component that is not a directory to determine the subtree for which credentials will apply.
+    // We keep a leading slash, but remove a trailing one.
+    String directoryURL = url.string().substring(0, url.pathEnd());
+    unsigned directoryURLPathStart = url.pathStart();
+    ASSERT(directoryURL[directoryURLPathStart] == '/');
+    if (directoryURL.length() > directoryURLPathStart + 1) {
+        int index = directoryURL.reverseFind('/');
+        ASSERT(index > 0);
+        directoryURL = directoryURL.substring(0, (static_cast<unsigned>(index) != directoryURLPathStart) ? index : directoryURLPathStart + 1);
+    }
+    ASSERT(directoryURL.length() == directoryURLPathStart + 1 || directoryURL[directoryURL.length() - 1] != '/');
+
+    return directoryURL;
+}
+
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
     ASSERT(url.protocolInHTTPFamily());
     ASSERT(url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
-    
+    originsWithCredentials().add(originStringFromURL(url));
+
     ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
-    if (url.protocolInHTTPFamily() && (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault)) {
-        String origin = originStringFromURL(url);
-        
-        HashMap<String, Credential> pathToCredentialMap;
-        pair<HashMap<String, HashMap<String, Credential> >::iterator, bool> result = originToDefaultBasicCredentialMap().add(origin, pathToCredentialMap);
-        
-        // Remove the last path component that is not a directory to determine the subpath for which this credential applies.
-        // We keep a leading slash, but remove a trailing one.
-        String path = url.path();
-        ASSERT(path.length() > 0);
-        ASSERT(path[0] == '/');
-        if (path.length() > 1) {
-            int index = path.reverseFind('/');
-            path = path.substring(0, index ? index : 1);
-        }
-        ASSERT(path.length() == 1 || path[path.length() - 1] != '/');
-        
-        result.first->second.set(path, credential);
+    if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
+        // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
+        pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
     }
 }
 
@@ -92,33 +103,53 @@ Credential CredentialStorage::get(const ProtectionSpace& protectionSpace)
     return protectionSpaceToCredentialMap().get(protectionSpace);
 }
 
-Credential CredentialStorage::getDefaultAuthenticationCredential(const KURL& url)
+static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForURL(const KURL& url)
 {
     ASSERT(url.protocolInHTTPFamily());
-    String origin = originStringFromURL(url);
-    const HashMap<String, Credential>& pathToCredentialMap(originToDefaultBasicCredentialMap().get(origin));
-    if (pathToCredentialMap.isEmpty())
-        return Credential();
-    
-    // Check to see if there is a stored credential for the subpath ancestry of this url.
-    String path = url.path();
-    Credential credential = pathToCredentialMap.get(path);
-    while (credential.isEmpty() && !path.isNull()) {
-        int index = path.reverseFind('/');
-        if (index == 0) {
-            credential = pathToCredentialMap.get("/");
-            break;
-        } else if (index == -1) {
-            // This case should never happen, as all HTTP URL paths should start with a leading /
-            ASSERT_NOT_REACHED();
-            credential = pathToCredentialMap.get(path);
-            break;
-        } else {
-            path = path.substring(0, index);
-            credential = pathToCredentialMap.get(path);
-        }
+    ASSERT(url.isValid());
+
+    PathToDefaultProtectionSpaceMap& map = pathToDefaultProtectionSpaceMap();
+
+    // Don't spend time iterating the path for origins that don't have any credentials.
+    if (!originsWithCredentials().contains(originStringFromURL(url)))
+        return map.end();
+
+    String directoryURL = protectionSpaceMapKeyFromURL(url);
+    unsigned directoryURLPathStart = url.pathStart();
+    while (true) {
+        PathToDefaultProtectionSpaceMap::iterator iter = map.find(directoryURL);
+        if (iter != map.end())
+            return iter;
+
+        if (directoryURL.length() == directoryURLPathStart + 1)  // path is "/" already, cannot shorten it any more
+            return map.end();
+
+        int index = directoryURL.reverseFind('/', -2);
+        ASSERT(index > 0);
+        directoryURL = directoryURL.substring(0, (static_cast<unsigned>(index) == directoryURLPathStart) ? index + 1 : index);
+        ASSERT(directoryURL.length() > directoryURLPathStart);
+        ASSERT(directoryURL.length() == directoryURLPathStart + 1 || directoryURL[directoryURL.length() - 1] != '/');
     }
-    return credential;
+}
+
+bool CredentialStorage::set(const Credential& credential, const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.isValid());
+    PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
+    if (iter == pathToDefaultProtectionSpaceMap().end())
+        return false;
+    ASSERT(originsWithCredentials().contains(originStringFromURL(url)));
+    protectionSpaceToCredentialMap().set(iter->second, credential);
+    return true;
+}
+
+Credential CredentialStorage::get(const KURL& url)
+{
+    PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
+    if (iter == pathToDefaultProtectionSpaceMap().end())
+        return Credential();
+    return protectionSpaceToCredentialMap().get(iter->second);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
index 737efa6..5086f69 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
@@ -36,7 +36,11 @@ class CredentialStorage {
 public:
     static void set(const Credential&, const ProtectionSpace&, const KURL&);
     static Credential get(const ProtectionSpace&);
-    static Credential getDefaultAuthenticationCredential(const KURL&);
+
+    // These methods work for authentication schemes that support sending credentials without waiting for a request. E.g., for HTTP Basic authentication scheme
+    // a client should assume that all paths at or deeper than the depth of a known protected resource share are within the same protection space.
+    static bool set(const Credential&, const KURL&); // Returns true if the URL corresponds to a known protection space, so credentials could be updated.
+    static Credential get(const KURL&);
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
index ff470a0..07c66e8 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -45,7 +45,7 @@ auto_ptr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
 
     HTTPHeaderMap::const_iterator end_it = end();
     for (HTTPHeaderMap::const_iterator it = begin(); it != end_it; ++it) {
-        data->append(make_pair(it->first.string().copy(), it->second.copy()));
+        data->append(make_pair(it->first.string().crossThreadString(), it->second.crossThreadString()));
     }
     return data;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
index 370650f..97435ba 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceErrorBase.cpp
@@ -34,10 +34,10 @@ ResourceError ResourceErrorBase::copy() const
     lazyInit();
 
     ResourceError errorCopy;
-    errorCopy.m_domain = m_domain.copy();
+    errorCopy.m_domain = m_domain.crossThreadString();
     errorCopy.m_errorCode = m_errorCode;
-    errorCopy.m_failingURL = m_failingURL.copy();
-    errorCopy.m_localizedDescription = m_localizedDescription.copy();
+    errorCopy.m_failingURL = m_failingURL.crossThreadString();
+    errorCopy.m_localizedDescription = m_localizedDescription.crossThreadString();
     errorCopy.m_isNull = m_isNull;
     errorCopy.m_isCancellation = m_isCancellation;
     return errorCopy;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
index a651a3f..4c77999 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
@@ -73,13 +73,13 @@ auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     data->m_cachePolicy = cachePolicy();
     data->m_timeoutInterval = timeoutInterval();
     data->m_firstPartyForCookies = firstPartyForCookies().copy();
-    data->m_httpMethod = httpMethod().copy();
+    data->m_httpMethod = httpMethod().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
 
     data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
     size_t encodingArraySize = m_responseContentDispositionEncodingFallbackArray.size();
     for (size_t index = 0; index < encodingArraySize; ++index) {
-        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].copy());
+        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].crossThreadString());
     }
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
index 7f8a4e2..fd44225 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
@@ -108,12 +108,12 @@ auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
 {
     auto_ptr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
     data->m_url = url().copy();
-    data->m_mimeType = mimeType().copy();
+    data->m_mimeType = mimeType().crossThreadString();
     data->m_expectedContentLength = expectedContentLength();
-    data->m_textEncodingName = textEncodingName().copy();
-    data->m_suggestedFilename = suggestedFilename().copy();
+    data->m_textEncodingName = textEncodingName().crossThreadString();
+    data->m_suggestedFilename = suggestedFilename().crossThreadString();
     data->m_httpStatusCode = httpStatusCode();
-    data->m_httpStatusText = httpStatusText().copy();
+    data->m_httpStatusText = httpStatusText().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
     data->m_lastModifiedDate = lastModifiedDate();
     return data;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 3303b34..202346d 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -112,23 +112,11 @@ qint64 FormDataIODevice::writeData(const char*, qint64)
     return -1;
 }
 
-void FormDataIODevice::setParent(QNetworkReply* reply)
-{
-    QIODevice::setParent(reply);
-
-    connect(reply, SIGNAL(finished()), SLOT(slotFinished()), Qt::QueuedConnection);
-}
-
 bool FormDataIODevice::isSequential() const
 {
     return true;
 }
 
-void FormDataIODevice::slotFinished()
-{
-    deleteLater();
-}
-
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
     , m_reply(0)
@@ -224,9 +212,7 @@ void QNetworkReplyHandler::finish()
     if (m_shouldFinish)
         return;
 
-    // FIXME: Investigate if this check should be moved into sendResponseIfNeeded()
-    if (!m_reply->error())
-        sendResponseIfNeeded();
+    sendResponseIfNeeded();
 
     if (!m_resourceHandle)
         return;
@@ -236,19 +222,20 @@ void QNetworkReplyHandler::finish()
         m_reply = 0;
         return;
     }
+
     QNetworkReply* oldReply = m_reply;
+
     if (m_redirected) {
         resetState();
         start();
     } else if (!m_reply->error() || ignoreHttpError(m_reply, m_responseDataSent)) {
         client->didFinishLoading(m_resourceHandle);
     } else {
-        int code = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
         QUrl url = m_reply->url();
+        int httpStatusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-        if (code) {
-            ResourceError error("HTTP", code, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
+        if (httpStatusCode) {
+            ResourceError error("HTTP", httpStatusCode, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
             client->didFail(m_resourceHandle, error);
         } else {
             ResourceError error("QtNetwork", m_reply->error(), url.toString(), m_reply->errorString());
@@ -267,6 +254,9 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (m_shouldSendResponse)
         return;
 
+    if (m_reply->error())
+        return;
+
     if (m_responseSent || !m_resourceHandle)
         return;
     m_responseSent = true;
@@ -290,40 +280,34 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     KURL url(m_reply->url());
-    String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
-
-    if (suggestedFilename.isEmpty())
-        suggestedFilename = url.lastPathComponent();
-
     ResourceResponse response(url, mimeType,
                               m_reply->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
-                              encoding,
-                              suggestedFilename);
+                              encoding, String());
 
-    const bool isLocalFileReply = (m_reply->url().scheme() == QLatin1String("file"));
-    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-    if (!isLocalFileReply) {
-        response.setHTTPStatusCode(statusCode);
-        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+    if (url.isLocalFile()) {
+        client->didReceiveResponse(m_resourceHandle, response);
+        return;
     }
-    else if (m_reply->error() == QNetworkReply::ContentNotFoundError)
-        response.setHTTPStatusCode(404);
 
+    // The status code is equal to 0 for protocols not in the HTTP family.
+    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-    /* Fill in the other fields
-     * For local file requests remove the content length and the last-modified
-     * headers as required by fast/dom/xmlhttprequest-get.xhtml
-     */
-    foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
-        if (isLocalFileReply
-            && (headerName == "Content-Length" || headerName == "Last-Modified"))
-            continue;
+    if (url.protocolInHTTPFamily()) {
+        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
 
-        response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
-    }
+        if (!suggestedFilename.isEmpty())
+            response.setSuggestedFilename(suggestedFilename);
+        else
+            response.setSuggestedFilename(url.lastPathComponent());
 
-    if (isLocalFileReply)
-        response.setHTTPHeaderField(QString::fromAscii("Cache-Control"), QString::fromAscii("no-cache"));
+        response.setHTTPStatusCode(statusCode);
+        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+
+        // Add remaining headers.
+        foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
+            response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
+        }
+    }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
@@ -339,9 +323,13 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         client->willSendRequest(m_resourceHandle, newRequest, response);
         m_redirected = true;
         m_request = newRequest.toNetworkRequest();
-    } else {
-        client->didReceiveResponse(m_resourceHandle, response);
+
+        ResourceHandleInternal* d = m_resourceHandle->getInternal();
+        emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+        return;
     }
+
+    client->didReceiveResponse(m_resourceHandle, response);
 }
 
 void QNetworkReplyHandler::forwardData()
@@ -379,6 +367,8 @@ void QNetworkReplyHandler::start()
 
     QNetworkAccessManager* manager = d->m_frame->page()->networkAccessManager();
 
+    emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
     // Post requests on files and data don't really make sense, but for
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 545119e..fccc4a6 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -96,16 +96,12 @@ public:
     FormDataIODevice(FormData*);
     ~FormDataIODevice();
 
-    void setParent(QNetworkReply*);
     bool isSequential() const;
 
 protected:
     qint64 readData(char*, qint64);
     qint64 writeData(const char*, qint64);
 
-private Q_SLOTS:
-    void slotFinished();
-
 private:
     void moveToNextElement();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
index 666ad18..9d2c452 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
@@ -239,8 +239,6 @@ static CachedImage* getCachedImage(Element* element)
 void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
-    Q_UNUSED(url);
-    Q_UNUSED(title);
 
     //WebCore::writeURL(m_writableDataObject.get(), url, title, true, false);
     if (!m_writableData)
@@ -262,8 +260,10 @@ void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, co
         return;
 
     QList<QUrl> urls;
+    urls.append(url);
     urls.append(fullURL);
 
+    m_writableData->setText(title);
     m_writableData->setUrls(urls);
 #ifndef QT_NO_CLIPBOARD
     if (!isForDragging())
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
index 77cac57..ca3ca9d 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
@@ -33,6 +33,7 @@
 #include "PlatformString.h"
 
 #include <QCoreApplication>
+#include <QLocale>
 
 namespace WebCore {
 
@@ -53,7 +54,8 @@ String resetButtonDefaultLabel()
 
 String defaultLanguage()
 {
-    return "en";
+    QLocale locale;
+    return locale.name().replace("_", "-");
 }
 
 String searchableIndexIntroduction()
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 935882a..37ea681 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -217,7 +217,7 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
         case Qt::Key_F9:
             return VK_F9;
         case Qt::Key_F10:
-            return VK_F11;
+            return VK_F10;
         case Qt::Key_F11:
             return VK_F11;
         case Qt::Key_F12:
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp
index 7ba8350..8221760 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -62,7 +62,7 @@ int screenDepthPerComponent(Widget* w)
         QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
 
         if (client) {
-            QWidget* view = QWidget::find(client->winId());
+            QWidget* view = client->ownerWidget();
             if (view)
                 return view->depth();
         }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
index b44f2ec..f6ec4f7 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
@@ -92,7 +92,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     rect.moveTopLeft(v->contentsToWindow(r.topLeft()));
     rect.setHeight(m_popup->sizeHint().height());
 
-    m_popup->setParent(QWidget::find(client->winId()));
+    m_popup->setParent(client->ownerWidget());
     m_popup->setGeometry(rect);
     m_popup->setCurrentIndex(index);
     m_popup->exec();
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h b/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
index 37941eb..28ef724 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QWebPageClient.h
@@ -32,35 +32,45 @@ class QWebPageClient {
 public:
     virtual void scroll(int dx, int dy, const QRect&) = 0;
     virtual void update(const QRect&) = 0;
-
     virtual void setInputMethodEnabled(bool enable) = 0;
 #if QT_VERSION >= 0x040600
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable) = 0;
 #endif
     inline void resetCursor()
     {
+#ifndef QT_NO_CURSOR
         if (!cursor().bitmap() && cursor().shape() == m_lastCursor.shape())
             return;
         updateCursor(m_lastCursor);
+#endif
     }
 
     inline void setCursor(const QCursor& cursor)
     {
+#ifndef QT_NO_CURSOR
         m_lastCursor = cursor;
         if (!cursor.bitmap() && cursor.shape() == this->cursor().shape())
             return;
         updateCursor(cursor);
+#endif
     }
 
+    virtual QPalette palette() const = 0;
     virtual int screenNumber() const = 0;
-    virtual WId winId() const = 0;
+    virtual QWidget* ownerWidget() const = 0;
+
+    virtual QObject* pluginParent() const = 0;
 
 protected:
+#ifndef QT_NO_CURSOR
     virtual QCursor cursor() const = 0;
     virtual void updateCursor(const QCursor& cursor) = 0;
+#endif
 
 private:
+#ifndef QT_NO_CURSOR
     QCursor m_lastCursor;
+#endif
 };
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index f505d0c..b61d356 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -44,6 +44,7 @@
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
+#include "UserAgentStyleSheets.h"
 #include "qwebpage.h"
 
 #include <QApplication>
@@ -771,13 +772,7 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
 
 String RenderThemeQt::extraMediaControlsStyleSheet()
 {
-    QFile platformStyleSheet(QLatin1String(":/webcore/css/mediaControls-extras.css"));
-    if (platformStyleSheet.open(QFile::ReadOnly)) {
-        QByteArray sheetData = platformStyleSheet.readAll();
-        return QString::fromUtf8(sheetData.constData(), sheetData.length());
-    }
-
-    return String();
+    return String(mediaControlsQtUserAgentStyleSheet, sizeof(mediaControlsQtUserAgentStyleSheet));
 }
 
 // Helper class to transform the painter's world matrix to the object's content area, scaled to 0,0,100,100
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp
index 7e178f9..0ad643e 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.cpp
@@ -32,10 +32,10 @@
 namespace WebCore {
 
 SQLValue::SQLValue(const SQLValue& val)
+    : m_type(val.m_type)
+    , m_number(val.m_number)
+    , m_string(val.m_string.threadsafeCopy())
 {
-    m_number = val.m_number;
-    m_string = val.m_string.copy();
-    m_type = val.m_type;
 }
 
 String SQLValue::string() const
@@ -43,7 +43,7 @@ String SQLValue::string() const
     ASSERT(m_type == StringValue);
 
     // Must return a copy since ref-shared Strings are not thread safe
-    return m_string.copy();
+    return m_string.threadsafeCopy();
 }
 
 double SQLValue::number() const
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h
index 7d85051..0f854fc 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLValue.h
@@ -38,9 +38,9 @@ namespace WebCore {
     public:
         enum Type { NullValue, NumberValue, StringValue };
 
-        SQLValue() : m_type(NullValue) { }
+        SQLValue() : m_type(NullValue), m_number(0.0) { }
         SQLValue(double number) : m_type(NumberValue), m_number(number) { }
-        SQLValue(const String& s) : m_type(StringValue), m_string(s) { }
+        SQLValue(const String& s) : m_type(StringValue), m_number(0.0), m_string(s) { }
         SQLValue(const SQLValue&);
 
         Type type() const { return m_type; }
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
index d313435..9982254 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteDatabase.h
@@ -24,8 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SQLDatabase_h
-#define SQLDatabase_h
+#ifndef SQLiteDatabase_h
+#define SQLiteDatabase_h
 
 #include "PlatformString.h"
 #include <wtf/Threading.h>
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
index 409439e..17d7832 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.cpp
@@ -65,7 +65,9 @@ struct CStringTranslator {
 
     static void translate(StringImpl*& location, const char* const& c, unsigned hash)
     {
-        location = new StringImpl(c, strlen(c), hash); 
+        location = StringImpl::create(c).releaseRef(); 
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -140,7 +142,9 @@ struct UCharBufferTranslator {
 
     static void translate(StringImpl*& location, const UCharBuffer& buf, unsigned hash)
     {
-        location = new StringImpl(buf.s, buf.length, hash); 
+        location = StringImpl::create(buf.s, buf.length).releaseRef(); 
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -164,7 +168,9 @@ struct HashAndCharactersTranslator {
 
     static void translate(StringImpl*& location, const HashAndCharacters& buffer, unsigned hash)
     {
-        location = new StringImpl(buffer.characters, buffer.length, hash); 
+        location = StringImpl::create(buffer.characters, buffer.length).releaseRef();
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -222,6 +228,16 @@ void AtomicString::remove(StringImpl* r)
 {
     stringTable().remove(r);
 }
+    
+AtomicString AtomicString::lower() const
+{
+    // Note: This is a hot function in the Dromaeo benchmark.
+    StringImpl* impl = this->impl();
+    RefPtr<StringImpl> newImpl = impl->lower();
+    if (LIKELY(newImpl == impl))
+        return *this;
+    return AtomicString(newImpl);
+}
 
 #if USE(JSC)
 PassRefPtr<StringImpl> AtomicString::add(const JSC::Identifier& identifier)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
index 3307a2d..8805f4c 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/AtomicString.h
@@ -83,6 +83,9 @@ public:
     bool endsWith(const String& s, bool caseSensitive = true) const
         { return m_string.endsWith(s, caseSensitive); }
     
+    AtomicString lower() const;
+    AtomicString upper() const { return AtomicString(impl()->upper()); }
+    
     int toInt(bool* ok = 0) const { return m_string.toInt(ok); }
     double toDouble(bool* ok = 0) const { return m_string.toDouble(ok); }
     float toFloat(bool* ok = 0) const { return m_string.toFloat(ok); }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index b9b4078..8d19c17 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -193,16 +193,13 @@ public:
 
     bool percentage(int& percentage) const;
 
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    String crossThreadString() const;
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since the underlying StringImpl objects are immutable, there's no other reason
     // to ever prefer copy() over plain old assignment.
-    String copy() const;
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, StringImpl::substring returns
-    // empty() which is not safe for another thread.)
-    String substringCopy(unsigned pos, unsigned len  = UINT_MAX) const;
+    String threadsafeCopy() const;
 
     bool isNull() const { return !m_impl; }
     bool isEmpty() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/String.cpp b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
index e892ef6..bef2674 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/String.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
@@ -263,13 +263,6 @@ String String::substring(unsigned pos, unsigned len) const
     return m_impl->substring(pos, len);
 }
 
-String String::substringCopy(unsigned pos, unsigned len) const
-{
-    if (!m_impl) 
-        return String();
-    return m_impl->substringCopy(pos, len);
-}
-
 String String::lower() const
 {
     if (!m_impl)
@@ -590,11 +583,18 @@ float String::toFloat(bool* ok) const
     return m_impl->toFloat(ok);
 }
 
-String String::copy() const
+String String::threadsafeCopy() const
+{
+    if (!m_impl)
+        return String();
+    return m_impl->threadsafeCopy();
+}
+
+String String::crossThreadString() const
 {
     if (!m_impl)
         return String();
-    return m_impl->copy();
+    return m_impl->crossThreadString();
 }
 
 bool String::isEmpty() const
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
index 8b749c7..5cf4ced 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
@@ -57,7 +57,7 @@ static inline void deleteUCharVector(const UChar* p)
 }
 
 // Some of the factory methods create buffers using fastMalloc.
-// We must ensure that ll allocations of StringImpl are allocated using
+// We must ensure that all allocations of StringImpl are allocated using
 // fastMalloc so that we don't have mis-matched frees. We accomplish 
 // this by overriding the new and delete operators.
 void* StringImpl::operator new(size_t size, void* address)
@@ -79,10 +79,9 @@ void StringImpl::operator delete(void* address)
 
 // This constructor is used only to create the empty string.
 StringImpl::StringImpl()
-    : m_length(0)
-    , m_data(0)
+    : m_data(0)
+    , m_length(0)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
     // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
     // with impunity. The empty string is special because it is never entered into
@@ -90,97 +89,20 @@ StringImpl::StringImpl()
     hash();
 }
 
-// This is one of the most common constructors, but it's also used for the copy()
-// operation. Because of that, it's the one constructor that doesn't assert the
-// length is non-zero, since we support copying the empty string.
 inline StringImpl::StringImpl(const UChar* characters, unsigned length)
-    : m_length(length)
+    : m_data(characters)
+    , m_length(length)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacter)
-    : m_length(str.m_length)
-    , m_hash(str.m_hash)
-    , m_bufferIsInternal(false)
-{
-    m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
-    UChar* data = newUCharVector(str.m_length + 1);
-    memcpy(data, str.m_data, str.m_length * sizeof(UChar));
-    data[str.m_length] = 0;
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const char* characters, unsigned length)
-    : m_length(length)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(characters);
-    ASSERT(length);
-
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
-    : m_length(length)
-    , m_data(characters)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(characters);
-    ASSERT(length);
-}
-
-// This constructor is only for use by AtomicString.
-StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
-    : m_length(length)
-    , m_hash(hash)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(hash);
-    ASSERT(characters);
-    ASSERT(length);
-
-    setInTable();
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-// This constructor is only for use by AtomicString.
-StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
-    : m_length(length)
-    , m_hash(hash)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(hash);
     ASSERT(characters);
     ASSERT(length);
-
-    setInTable();
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
 }
 
 StringImpl::~StringImpl()
 {
     if (inTable())
         AtomicString::remove(this);
-    if (!m_bufferIsInternal) {
+    if (!bufferIsInternal()) {
         SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
         if (sharedBuffer)
             sharedBuffer->deref();
@@ -218,15 +140,6 @@ PassRefPtr<StringImpl> StringImpl::substring(unsigned start, unsigned length)
     return create(m_data + start, length);
 }
 
-PassRefPtr<StringImpl> StringImpl::substringCopy(unsigned start, unsigned length)
-{
-    start = min(start, m_length);
-    length = min(length, m_length - start);
-    if (!length)
-        return adoptRef(new StringImpl);
-    return create(m_data + start, length);
-}
-
 UChar32 StringImpl::characterStartingAt(unsigned i)
 {
     if (U16_IS_SINGLE(m_data[i]))
@@ -236,46 +149,38 @@ UChar32 StringImpl::characterStartingAt(unsigned i)
     return 0;
 }
 
-bool StringImpl::isLower()
+PassRefPtr<StringImpl> StringImpl::lower()
 {
-    // Do a faster loop for the case where all the characters are ASCII.
-    bool allLower = true;
+    // Note: This is a hot function in the Dromaeo benchmark, specifically the
+    // no-op code path up through the first 'return' statement.
+    
+    // First scan the string for uppercase and non-ASCII characters:
     UChar ored = 0;
-    for (unsigned i = 0; i < m_length; i++) {
-        UChar c = m_data[i];
-        allLower = allLower && isASCIILower(c);
-        ored |= c;
-    }
-    if (!(ored & ~0x7F))
-        return allLower;
-
-    // Do a slower check for cases that include non-ASCII characters.
-    allLower = true;
-    unsigned i = 0;
-    while (i < m_length) {
-        UChar32 character;
-        U16_NEXT(m_data, i, m_length, character)
-        allLower = allLower && Unicode::isLower(character);
+    bool noUpper = true;
+    const UChar *end = m_data + m_length;
+    for (const UChar* chp = m_data; chp != end; chp++) {
+        if (UNLIKELY(isASCIIUpper(*chp)))
+            noUpper = false;
+        ored |= *chp;
     }
-    return allLower;
-}
+    
+    // Nothing to do if the string is all ASCII with no uppercase.
+    if (noUpper && !(ored & ~0x7F))
+        return this;
 
-PassRefPtr<StringImpl> StringImpl::lower()
-{
-    UChar* data;
-    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
+    UChar* data;
+    RefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
 
-    // Do a faster loop for the case where all the characters are ASCII.
-    UChar ored = 0;
-    for (int i = 0; i < length; i++) {
-        UChar c = m_data[i];
-        ored |= c;
-        data[i] = toASCIILower(c);
-    }
-    if (!(ored & ~0x7F))
+    if (!(ored & ~0x7F)) {
+        // Do a faster loop for the case where all the characters are ASCII.
+        for (int i = 0; i < length; i++) {
+            UChar c = m_data[i];
+            data[i] = toASCIILower(c);
+        }
         return newImpl;
-
+    }
+    
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
     int32_t realLength = Unicode::toLower(data, length, m_data, m_length, &error);
@@ -290,6 +195,9 @@ PassRefPtr<StringImpl> StringImpl::lower()
 
 PassRefPtr<StringImpl> StringImpl::upper()
 {
+    // This function could be optimized for no-op cases the way lower() is,
+    // but in empirical testing, few actual calls to upper() are no-ops, so
+    // it wouldn't be worth the extra time for pre-scanning.
     UChar* data;
     PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
@@ -374,6 +282,8 @@ PassRefPtr<StringImpl> StringImpl::stripWhiteSpace()
     while (end && isSpaceOrNewline(m_data[end]))
         end--;
 
+    if (!start && end == m_length - 1)
+        return this;
     return create(m_data + start, end + 1 - start);
 }
 
@@ -416,12 +326,16 @@ PassRefPtr<StringImpl> StringImpl::simplifyWhiteSpace()
     const UChar* from = m_data;
     const UChar* fromend = from + m_length;
     int outc = 0;
+    bool changedToSpace = false;
     
     UChar* to = data.characters();
     
     while (true) {
-        while (from != fromend && isSpaceOrNewline(*from))
+        while (from != fromend && isSpaceOrNewline(*from)) {
+            if (*from != ' ')
+                changedToSpace = true;
             from++;
+        }
         while (from != fromend && !isSpaceOrNewline(*from))
             to[outc++] = *from++;
         if (from != fromend)
@@ -433,6 +347,9 @@ PassRefPtr<StringImpl> StringImpl::simplifyWhiteSpace()
     if (outc > 0 && to[outc - 1] == ' ')
         outc--;
     
+    if (static_cast<unsigned>(outc) == m_length && !changedToSpace)
+        return this;
+    
     data.shrink(outc);
     
     return adopt(data);
@@ -985,7 +902,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(StringBuffer& buffer)
     unsigned length = buffer.length();
     if (length == 0)
         return empty();
-    return adoptRef(new StringImpl(buffer.release(), length, AdoptBuffer()));
+    return adoptRef(new StringImpl(buffer.release(), length));
 }
 
 PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
@@ -993,7 +910,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
     size_t size = vector.size();
     if (size == 0)
         return empty();
-    return adoptRef(new StringImpl(vector.releaseBuffer(), size, AdoptBuffer()));
+    return adoptRef(new StringImpl(vector.releaseBuffer(), size));
 }
 
 PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
@@ -1007,10 +924,9 @@ PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*&
     // struct as well as the data which it contains. This removes one 
     // heap allocation from this call.
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
-    char* buffer = static_cast<char*>(fastMalloc(size));
-    data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
-    StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
-    string->m_bufferIsInternal = true;
+    StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
+    data = reinterpret_cast<UChar*>(string + 1);
+    string = new (string) StringImpl(data, length);
     return adoptRef(string);
 }
 
@@ -1051,7 +967,7 @@ PassRefPtr<StringImpl> StringImpl::create(const JSC::UString& str)
 {
     SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->sharedBuffer();
     if (sharedBuffer) {
-        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(str.data()), str.size(), AdoptBuffer()));
+        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(str.data(), str.size()));
         sharedBuffer->ref();
         impl->m_sharedBufferAndFlags.set(sharedBuffer);
         return impl;
@@ -1071,18 +987,43 @@ JSC::UString StringImpl::ustring()
 
 PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const StringImpl& string)
 {
-    return adoptRef(new StringImpl(string, WithTerminatingNullCharacter()));
+    // Use createUninitialized instead of 'new StringImpl' so that the string and its buffer
+    // get allocated in a single malloc block.
+    UChar* data;
+    int length = string.m_length;
+    RefPtr<StringImpl> terminatedString = createUninitialized(length + 1, data);
+    memcpy(data, string.m_data, length * sizeof(UChar));
+    data[length] = 0;
+    terminatedString->m_length--;
+    terminatedString->m_hash = string.m_hash;
+    terminatedString->m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
+    return terminatedString.release();
 }
 
-PassRefPtr<StringImpl> StringImpl::copy()
+PassRefPtr<StringImpl> StringImpl::threadsafeCopy() const
 {
-    // Using the constructor directly to make sure that per-thread empty string instance isn't returned.
-    return adoptRef(new StringImpl(m_data, m_length));
+    // Special-case empty strings to make sure that per-thread empty string instance isn't returned.
+    if (m_length == 0)
+        return adoptRef(new StringImpl);
+    return create(m_data, m_length);
+}
+
+PassRefPtr<StringImpl> StringImpl::crossThreadString()
+{
+    SharedUChar* shared = sharedBuffer();
+    if (shared) {
+        RefPtr<StringImpl> impl = adoptRef(new StringImpl(m_data, m_length));
+        impl->m_sharedBufferAndFlags.set(shared->crossThreadCopy().releaseRef());
+        return impl.release();
+    }
+
+    // If no shared buffer is available, create a copy.
+    return threadsafeCopy();
 }
 
 StringImpl::SharedUChar* StringImpl::sharedBuffer()
 {
-    if (m_length < minLengthToShare || m_bufferIsInternal)
+    if (m_length < minLengthToShare || bufferIsInternal())
         return 0;
 
     if (!m_sharedBufferAndFlags.get())
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
index 8b4e82d..dac25b2 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
@@ -47,7 +47,6 @@ typedef const struct __CFString * CFStringRef;
 
 namespace WebCore {
 
-class AtomicString;
 class StringBuffer;
 
 struct CStringTranslator;
@@ -60,26 +59,19 @@ enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
 typedef bool (*CharacterMatchFunctionPtr)(UChar);
 
 class StringImpl : public RefCounted<StringImpl> {
-    friend class AtomicString;
     friend struct CStringTranslator;
     friend struct HashAndCharactersTranslator;
     friend struct UCharBufferTranslator;
 private:
     friend class ThreadGlobalData;
     StringImpl();
+    
+    // This adopts the UChar* without copying the buffer.
     StringImpl(const UChar*, unsigned length);
-    StringImpl(const char*, unsigned length);
-
-    struct AdoptBuffer { };
-    StringImpl(UChar*, unsigned length, AdoptBuffer);
-
-    struct WithTerminatingNullCharacter { };
-    StringImpl(const StringImpl&, WithTerminatingNullCharacter);
-
-    // For AtomicString.
-    StringImpl(const UChar*, unsigned length, unsigned hash);
-    StringImpl(const char*, unsigned length, unsigned hash);
 
+    // For use only by AtomicString's XXXTranslator helpers.
+    void setHash(unsigned hash) { ASSERT(!m_hash); m_hash = hash; }
+    
     typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
 
 public:
@@ -114,15 +106,12 @@ public:
     static unsigned computeHash(const UChar*, unsigned len);
     static unsigned computeHash(const char*);
     
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    PassRefPtr<StringImpl> crossThreadString();
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since StringImpl objects are immutable, there's no other reason to make a copy.
-    PassRefPtr<StringImpl> copy();
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, substring returns empty() which
-    // is not safe for another thread.)
-    PassRefPtr<StringImpl> substringCopy(unsigned pos, unsigned len  = UINT_MAX);
+    PassRefPtr<StringImpl> threadsafeCopy() const;
 
     PassRefPtr<StringImpl> substring(unsigned pos, unsigned len = UINT_MAX);
 
@@ -146,7 +135,6 @@ public:
     double toDouble(bool* ok = 0);
     float toFloat(bool* ok = 0);
 
-    bool isLower();
     PassRefPtr<StringImpl> lower();
     PassRefPtr<StringImpl> upper();
     PassRefPtr<StringImpl> secure(UChar aChar);
@@ -166,7 +154,7 @@ public:
     int reverseFind(UChar, int index);
     int reverseFind(StringImpl*, int index, bool caseSensitive = true);
     
-    bool startsWith(StringImpl* m_data, bool caseSensitive = true) { return reverseFind(m_data, 0, caseSensitive) == 0; }
+    bool startsWith(StringImpl* str, bool caseSensitive = true) { return reverseFind(str, 0, caseSensitive) == 0; }
     bool endsWith(StringImpl*, bool caseSensitive = true);
 
     PassRefPtr<StringImpl> replace(UChar, UChar);
@@ -196,21 +184,22 @@ private:
     void* operator new(size_t size, void* address);
 
     static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
+    
+    // The StringImpl struct and its data may be allocated within a single heap block.
+    // In this case, the m_data pointer is an "internal buffer", and does not need to be deallocated.
+    bool bufferIsInternal() { return m_data == reinterpret_cast<const UChar*>(this + 1); }
 
     enum StringImplFlags {
         HasTerminatingNullCharacter,
         InTable,
     };
 
-    unsigned m_length;
     const UChar* m_data;
+    unsigned m_length;
     mutable unsigned m_hash;
     PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
-
-    // In some cases, we allocate the StringImpl struct and its data
-    // within a single heap buffer. In this case, the m_data pointer
-    // is an "internal buffer", and does not need to be deallocated.
-    bool m_bufferIsInternal;
+    // There is a fictitious variable-length UChar array at the end, which is used
+    // as the internal buffer by the createUninitialized and create methods.
 };
 
 bool equal(StringImpl*, StringImpl*);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
index 5d82511..d3e2965 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -129,6 +129,10 @@ static TextEncodingNameMap* textEncodingNameMap;
 static TextCodecMap* textCodecMap;
 static bool didExtendTextCodecMaps;
 
+static const char* const textEncodingNameBlacklist[] = {
+    "UTF-7"
+};
+
 #if ERROR_DISABLED
 
 static inline void checkExistingName(const char*, const char*) { }
@@ -171,6 +175,30 @@ static void addToTextCodecMap(const char* name, NewTextCodecFunction function, c
     textCodecMap->add(atomicName, TextCodecFactory(function, additionalData));
 }
 
+static void pruneBlacklistedCodecs()
+{
+    size_t blacklistedCodecListLength = sizeof(textEncodingNameBlacklist) / sizeof(textEncodingNameBlacklist[0]);
+    for (size_t i = 0; i < blacklistedCodecListLength; ++i) {
+        const char* atomicName = textEncodingNameMap->get(textEncodingNameBlacklist[i]);
+        if (!atomicName)
+            continue;
+
+        Vector<const char*> names;
+        TextEncodingNameMap::const_iterator it = textEncodingNameMap->begin();
+        TextEncodingNameMap::const_iterator end = textEncodingNameMap->end();
+        for (; it != end; ++it) {
+            if (it->second == atomicName)
+                names.append(it->first);
+        }
+
+        size_t length = names.size();
+        for (size_t j = 0; j < length; ++j)
+            textEncodingNameMap->remove(names[j]);
+
+        textCodecMap->remove(atomicName);
+    }
+}
+
 static void buildBaseTextCodecMaps()
 {
     ASSERT(isMainThread());
@@ -221,6 +249,8 @@ static void extendTextCodecMaps()
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
 #endif
+
+    pruneBlacklistedCodecs();
 }
 
 PassOwnPtr<TextCodec> newTextCodec(const TextEncoding& encoding)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
index e351522..b3f75cc 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -104,7 +104,7 @@ String TextCodecQt::decode(const char* bytes, size_t length, bool flush, bool /*
 #endif
     const char* buf = bytes;
     const char* end = buf + length;
-    String unicode;
+    String unicode(""); // a non-null string is expected
 
     while (buf < end) {
         int size = end - buf;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
index 28e3967..3b98383 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDataNone.cpp
@@ -27,18 +27,14 @@
 #include "config.h"
 #include "PluginData.h"
 
-#include "NotImplemented.h"
-
 namespace WebCore {
 
 void PluginData::initPlugins()
 {
-    notImplemented();
 }
 
 void PluginData::refresh()
 {
-    notImplemented();
 }
 
 };
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
index f40ed95..c7979d1 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
@@ -320,7 +320,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if !PLATFORM(WIN_OS) || PLATFORM(WX)
+#if (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -355,6 +355,8 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     paths.append("/usr/lib/netscape/plugins-libc6");
     paths.append("/usr/lib64/netscape/plugins");
     paths.append("/usr/lib64/mozilla/plugins");
+    paths.append("/usr/lib/nsbrowser/plugins");
+    paths.append("/usr/lib64/nsbrowser/plugins");
 
     String mozHome(getenv("MOZILLA_HOME"));
     mozHome.append("/plugins");
@@ -426,6 +428,6 @@ void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
     }
 }
 
-#endif // !PLATFORM(WIN_OS)
+#endif // !PLATFORM(SYMBIAN) && !PLATFORM(WIN_OS)
 
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
index 612a9d7..19337f0 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
@@ -113,6 +113,7 @@ PluginPackage::PluginPackage(const String& path, const time_t& lastModified)
     m_parentDirectory = m_path.left(m_path.length() - m_fileName.length() - 1);
 }
 
+#if !PLATFORM(SYMBIAN)
 void PluginPackage::unload()
 {
     if (!m_isLoaded)
@@ -125,6 +126,7 @@ void PluginPackage::unload()
 
     unloadWithoutShutdown();
 }
+#endif //!PLATFORM(SYMBIAN)
 
 void PluginPackage::unloadWithoutShutdown()
 {
@@ -183,6 +185,7 @@ void PluginPackage::determineQuirks(const String& mimeType)
 #if PLATFORM(QT)
             m_quirks.add(PluginQuirkRequiresGtkToolKit);
 #endif
+            m_quirks.add(PluginQuirkRequiresDefaultScreenDepth);
         } else {
             // Flash 9 and older requests windowless plugins if we return a mozilla user agent
             m_quirks.add(PluginQuirkWantsMozillaUserAgent);
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
index 3afc57f..d409ab6 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
@@ -36,6 +36,11 @@
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
+#if PLATFORM(SYMBIAN)
+class QPluginLoader;
+class NPInterface;
+#endif
+
 namespace WebCore {
     typedef HashMap<String, String> MIMEToDescriptionsMap;
     typedef HashMap<String, Vector<String> > MIMEToExtensionsMap;
@@ -70,9 +75,17 @@ namespace WebCore {
         int compare(const PluginPackage&) const;
         PluginQuirkSet quirks() const { return m_quirks; }
         const PlatformModuleVersion& version() const { return m_moduleVersion; }
+#if PLATFORM(SYMBIAN)
+        NPInterface* npInterface() const { return m_npInterface; }
+#endif // PLATFORM(SYMBIAN)
 
     private:
         PluginPackage(const String& path, const time_t& lastModified);
+
+#if PLATFORM(SYMBIAN)
+        NPInterface* m_npInterface;
+        QPluginLoader* m_pluginLoader;
+#endif // PLATFORM(SYMBIAN)
         bool fetchInfo();
         bool isPluginBlacklisted();
         void determineQuirks(const String& mimeType);
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
index 487450a..b943d88 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackageNone.cpp
@@ -26,52 +26,20 @@
 #include "config.h"
 #include "PluginPackage.h"
 
-#include "CString.h"
-#include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
-#include "npruntime_impl.h"
-#include "PluginDatabase.h"
-#include "PluginDebug.h"
-
 namespace WebCore {
 
 void PluginPackage::determineQuirks(const String&)
 {
-    notImplemented();
 }
 
 bool PluginPackage::fetchInfo()
 {
-    notImplemented();
     return false;
 }
 
 bool PluginPackage::load()
 {
-    notImplemented();
-    return false;
-}
-
-#if !ENABLE(PLUGIN_PACKAGE_SIMPLE_HASH)
-unsigned PluginPackage::hash() const
-{ 
-    notImplemented();
-
-    return 0;
-}
-
-bool PluginPackage::equal(const PluginPackage&, const PluginPackage&)
-{
-    notImplemented();
     return false;
 }
 
-int PluginPackage::compareFileVersion(const PlatformModuleVersion&) const
-{
-    notImplemented();
-    return 0;
-}
-
-#endif
-
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h b/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
index b652c6e..de29baf 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
@@ -46,6 +46,7 @@ namespace WebCore {
         PluginQuirkDontSetNullWindowHandleOnDestroy = 1 << 10,
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
         PluginQuirkRequiresGtkToolKit = 1 << 12,
+        PluginQuirkRequiresDefaultScreenDepth = 1 << 13
     };
 
     class PluginQuirkSet {
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
index 28572a4..8320bc4 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
@@ -53,6 +53,7 @@
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "ScriptValue.h"
+#include "SecurityOrigin.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
@@ -123,12 +124,12 @@ void PluginView::setFrameRect(const IntRect& rect)
 
     updatePluginWidget();
 
-#if PLATFORM(WIN_OS)
-    // On Windows, always call plugin to change geometry.
+#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+    // On Windows and Symbian, always call plugin to change geometry.
     setNPWindowRect(rect);
 #elif XP_UNIX
-    // On Unix, only call plugin if it's full-page.
-    if (m_mode == NP_FULL)
+    // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
+    if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
 #endif
 }
@@ -147,6 +148,12 @@ void PluginView::handleEvent(Event* event)
         handleMouseEvent(static_cast<MouseEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+    else if (event->type() == eventNames().DOMFocusOutEvent)
+        handleFocusOutEvent();
+    else if (event->type() == eventNames().DOMFocusInEvent)
+        handleFocusInEvent();
+#endif
 }
 
 void PluginView::init()
@@ -234,7 +241,13 @@ bool PluginView::start()
     if (!platformStart())
         m_status = PluginStatusCanNotLoadPlugin;
 
-    return (m_status == PluginStatusLoadedSuccessfully);
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return false;
+
+    if (parentFrame()->page())
+        parentFrame()->page()->didStartPlugin(this);
+
+    return true;
 }
 
 PluginView::~PluginView()
@@ -274,6 +287,9 @@ void PluginView::stop()
     if (!m_isStarted)
         return;
 
+    if (parentFrame()->page())
+        parentFrame()->page()->didStopPlugin(this);
+
     LOG(Plugins, "PluginView::stop(): Stopping plug-in '%s'", m_plugin->name().utf8().data());
 
     HashSet<RefPtr<PluginStream> > streams = m_streams;
@@ -434,7 +450,7 @@ void PluginView::performRequest(PluginRequest* request)
     
     // Executing a script can cause the plugin view to be destroyed, so we keep a reference to the parent frame.
     RefPtr<Frame> parentFrame = m_parentFrame;
-    JSValue result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
+    JSValue result = m_parentFrame->script()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
 
     if (targetFrameName.isNull()) {
         String resultString;
@@ -501,9 +517,8 @@ NPError PluginView::load(const FrameLoadRequest& frameLoadRequest, bool sendNoti
         // For security reasons, only allow JS requests to be made on the frame that contains the plug-in.
         if (!targetFrameName.isNull() && m_parentFrame->tree()->find(targetFrameName) != m_parentFrame)
             return NPERR_INVALID_PARAM;
-    } else if (!FrameLoader::canLoad(url, String(), m_parentFrame->document())) {
+    } else if (!SecurityOrigin::canLoad(url, String(), m_parentFrame->document()))
             return NPERR_GENERIC_ERROR;
-    }
 
     PluginRequest* request = new PluginRequest(frameLoadRequest, sendNotification, notifyData, arePopupsAllowed());
     scheduleRequest(request);
@@ -803,12 +818,18 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
 #endif
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
     , m_hasPendingGeometryChange(false)
+    , m_drawable(0)
+    , m_visual(0)
+    , m_colormap(0)
+    , m_pluginDisplay(0)
 #endif
     , m_loadManually(loadManually)
     , m_manualStream(0)
     , m_isJavaScriptPaused(false)
+    , m_isHalted(false)
+    , m_hasBeenHalted(false)
 {
     if (!m_plugin) {
         m_status = PluginStatusCanNotFindPlugin;
@@ -1214,4 +1235,10 @@ const char* PluginView::userAgentStatic()
 }
 #endif
 
+
+Node* PluginView::node() const
+{
+    return m_element;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
index 54c1065..1477561 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
@@ -29,6 +29,7 @@
 
 #include "CString.h"
 #include "FrameLoadRequest.h"
+#include "HaltablePlugin.h"
 #include "IntRect.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -106,7 +107,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&) = 0;
     };
 
-    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader {
+    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader, private HaltablePlugin {
     public:
         static PassRefPtr<PluginView> create(Frame* parentFrame, const IntSize&, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
         virtual ~PluginView();
@@ -193,6 +194,14 @@ namespace WebCore {
         void didFinishLoading();
         void didFail(const ResourceError&);
 
+        // HaltablePlugin
+        virtual void halt();
+        virtual void restart();
+        virtual Node* node() const;
+
+        bool isHalted() const { return m_isHalted; }
+        bool hasBeenHalted() const { return m_hasBeenHalted; }
+
         static bool isCallingPlugin();
 
         bool start();
@@ -249,6 +258,10 @@ namespace WebCore {
 
         void handleKeyboardEvent(KeyboardEvent*);
         void handleMouseEvent(MouseEvent*);
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+        void handleFocusInEvent();
+        void handleFocusOutEvent();
+#endif
 
         int m_mode;
         int m_paramCount;
@@ -295,12 +308,13 @@ public:
         void setPlatformPluginWidget(PlatformPluginWidget widget) { m_window = widget; }
 #else
 public:
+        void setPlatformPluginWidget(PlatformPluginWidget widget) { setPlatformWidget(widget); }
         PlatformPluginWidget platformPluginWidget() const { return platformWidget(); }
 #endif
 
 private:
 
-#if defined(XP_UNIX) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11) || PLATFORM(SYMBIAN)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
@@ -313,8 +327,14 @@ private:
         Point globalMousePosForPlugin() const;
 #endif
 
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
         bool m_hasPendingGeometryChange;
+        Pixmap m_drawable;
+        Visual* m_visual;
+        Colormap m_colormap;
+        Display* m_pluginDisplay;
+
+        void initXEvent(XEvent* event);
 #endif
 
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
@@ -325,6 +345,9 @@ private:
 
         bool m_isJavaScriptPaused;
 
+        bool m_isHalted;
+        bool m_hasBeenHalted;
+
         static PluginView* s_currentPluginView;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
index b694214..725af82 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
@@ -26,114 +26,98 @@
 #include "config.h"
 #include "PluginView.h"
 
-#include "NotImplemented.h"
-#include "PluginPackage.h"
-
 using namespace WTF;
 
 namespace WebCore {
 
 void PluginView::setFocus()
 {
-    notImplemented();
 }
 
 void PluginView::show()
 {
-    notImplemented();
 }
 
 void PluginView::hide()
 {
-    notImplemented();
 }
 
 void PluginView::paint(GraphicsContext*, const IntRect&)
 {
-    notImplemented();
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent*)
 {
-    notImplemented();
 }
 
 void PluginView::handleMouseEvent(MouseEvent*)
 {
-    notImplemented();
 }
 
 void PluginView::setParent(ScrollView*)
 {
-    notImplemented();
 }
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    notImplemented();
 }
 
 NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
 {
-    notImplemented();
-
     return 0;
 }
 
 NPError PluginView::getValue(NPNVariable, void*)
 {
-    notImplemented();
     return 0;
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 NPError PluginView::getValueStatic(NPNVariable variable, void* value)
 {
-    notImplemented();
     return 0;
 }
 #endif
 
 void PluginView::invalidateRect(NPRect*)
 {
-    notImplemented();
 }
 
 void PluginView::invalidateRect(const IntRect&)
 {
-    notImplemented();
 }
 
 void PluginView::invalidateRegion(NPRegion)
 {
-    notImplemented();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
 }
 
 bool PluginView::platformStart()
 {
-    notImplemented();
-
     return true;
 }
 
 void PluginView::platformDestroy()
 {
-    notImplemented();
 }
 
 void PluginView::setParentVisible(bool)
 {
-    notImplemented();
 }
 
 void PluginView::updatePluginWidget()
 {
-    notImplemented();
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
index d242fb8..325bc4d 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -159,7 +159,8 @@ bool PluginPackage::fetchInfo()
             plist = readPListFile(path.get(), /*createFile*/ true, m_module);
         }
 
-        mimeDict = (CFDictionaryRef)CFDictionaryGetValue(plist.get(), CFSTR("WebPluginMIMETypes"));
+        if (plist)
+            mimeDict = (CFDictionaryRef)CFDictionaryGetValue(plist.get(), CFSTR("WebPluginMIMETypes"));
     }
 
     if (!mimeDict)
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
index 226aab6..6521c84 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
@@ -174,8 +174,8 @@ bool PluginView::platformStart()
 
 #if PLATFORM(QT)
     if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
-        if (QWidget* window = QWidget::find(client->winId())) {
-            setPlatformPluginWidget(window);
+        if (QWidget* widget = client->ownerWidget()) {
+            setPlatformPluginWidget(widget);
         }
     }
 #endif
@@ -692,6 +692,14 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
+}
+
 } // namespace WebCore
 
 #else
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
index 59ab5bc..cb894a7 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginContainerQt.cpp
@@ -73,6 +73,7 @@ PluginContainerQt::PluginContainerQt(PluginView* view, QWidget* parent)
 PluginContainerQt::~PluginContainerQt()
 {
     delete m_clientWrapper;
+    m_pluginView->setPlatformPluginWidget(0);
 }
 
 void PluginContainerQt::on_clientClosed()
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
index 7f5a7b9..8119924 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -80,6 +80,16 @@ bool PluginPackage::fetchInfo()
     return true;
 }
 
+static NPError staticPluginQuirkRequiresGtkToolKit_NPN_GetValue(NPP instance, NPNVariable variable, void* value)
+{
+    if (variable == NPNVToolkit) {
+        *static_cast<uint32*>(value) = 2;
+        return NPERR_NO_ERROR;
+    }
+
+    return NPN_GetValue(instance, variable, value);
+}
+
 bool PluginPackage::load()
 {
     if (m_isLoaded) {
@@ -111,6 +121,12 @@ bool PluginPackage::load()
 
     initializeBrowserFuncs();
 
+    if (m_path.contains("npwrapper.")) {
+        // nspluginwrapper relies on the toolkit value to know if glib is available
+        // It does so in NP_Initialize with a null instance, therefore it is done this way:
+        m_browserFuncs.getvalue = staticPluginQuirkRequiresGtkToolKit_NPN_GetValue;
+    }
+
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
 #else
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
index 908e707..28637a1 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +31,8 @@
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
+#include "FloatPoint.h"
+#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
@@ -57,12 +60,20 @@
 #include "runtime.h"
 #include "runtime_root.h"
 #include "QWebPageClient.h"
+#include <QApplication>
+#include <QDesktopWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include <QWidget>
 #include <QX11Info>
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <X11/X.h>
+#ifndef QT_NO_XRENDER
+#define Bool int
+#define Status int
+#include <X11/extensions/Xrender.h>
+#endif
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -80,7 +91,7 @@ using namespace HTMLNames;
 
 void PluginView::updatePluginWidget()
 {
-    if (!parent() || !m_isWindowed || !platformPluginWidget())
+    if (!parent())
         return;
 
     ASSERT(parent()->isFrameView());
@@ -96,6 +107,15 @@ void PluginView::updatePluginWidget()
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
         return;
 
+    if (!m_isWindowed && m_windowRect.size() != oldWindowRect.size()) {
+        if (m_drawable)
+            XFreePixmap(QX11Info::display(), m_drawable);
+
+        m_drawable = XCreatePixmap(QX11Info::display(), QX11Info::appRootWindow(), m_windowRect.width(), m_windowRect.height(), 
+                                   ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
+        QApplication::syncX(); // make sure that the server knows about the Drawable
+    }
+
     // do not call setNPWindowIfNeeded immediately, will be called on paint()
     m_hasPendingGeometryChange = true;
 
@@ -150,8 +170,67 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled())
         return;
 
-    if (m_isWindowed && platformPluginWidget())
-        setNPWindowIfNeeded();
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed || !m_drawable)
+        return;
+
+    const bool syncX = m_pluginDisplay && m_pluginDisplay != QX11Info::display();
+
+    QPainter* painter = context->platformContext();
+
+    QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
+    const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
+    ASSERT(drawableDepth == qtDrawable.depth());
+
+    if (m_isTransparent && drawableDepth != 32) {
+        // Attempt content propagation for drawable with no alpha by copying over from the backing store
+        QPoint offset;
+        QPaintDevice* backingStoreDevice =  QPainter::redirected(painter->device(), &offset);
+        offset = -offset; // negating the offset gives us the offset of the view within the backing store pixmap
+
+        const bool hasValidBackingStore = backingStoreDevice && backingStoreDevice->devType() == QInternal::Pixmap;
+        QPixmap* backingStorePixmap = static_cast<QPixmap*>(backingStoreDevice);
+
+        // We cannot grab contents from the backing store when painting on QGraphicsView items
+        // (because backing store contents are already transformed). What we really mean to do 
+        // here is to check if we are painting on QWebView, but let's be a little permissive :)
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        const bool backingStoreHasUntransformedContents = client && qobject_cast<QWidget*>(client->pluginParent());
+
+        if (hasValidBackingStore && backingStorePixmap->depth() == drawableDepth 
+            && backingStoreHasUntransformedContents) {
+            GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
+            XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
+                offset.x() + m_windowRect.x() + m_clipRect.x(), offset.y() + m_windowRect.y() + m_clipRect.y(),
+                m_clipRect.width(), m_clipRect.height(), m_clipRect.x(), m_clipRect.y());
+        } else { // no backing store, clean the pixmap because the plugin thinks its transparent
+            QPainter painter(&qtDrawable);
+            painter.fillRect(m_clipRect, Qt::white);
+        }
+
+        if (syncX)
+            QApplication::syncX();
+    }
+
+    XEvent xevent;
+    memset(&xevent, 0, sizeof(XEvent));
+    XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
+    exposeEvent.type = GraphicsExpose;
+    exposeEvent.display = QX11Info::display();
+    exposeEvent.drawable = m_drawable;
+    exposeEvent.x = m_clipRect.x();
+    exposeEvent.y = m_clipRect.y();
+    exposeEvent.width = m_clipRect.x() + m_clipRect.width(); // flash bug? it thinks width is the right
+    exposeEvent.height = m_clipRect.y() + m_clipRect.height(); // flash bug? it thinks height is the bottom
+
+    dispatchNPEvent(xevent);
+
+    if (syncX)
+        XSync(m_pluginDisplay, False); // sync changes by plugin
+
+    painter->drawPixmap(frameRect().x() + m_clipRect.x(), frameRect().y() + m_clipRect.y(), qtDrawable,
+        m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height());
 }
 
 // TODO: Unify across ports.
@@ -161,45 +240,55 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
         return false;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(false);
-
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
-    bool accepted = m_plugin->pluginFuncs();
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
     setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
 
     return accepted;
 }
 
-void setSharedXEventFields(XEvent& xEvent, QWidget* hostWindow)
+void setSharedXEventFields(XEvent* xEvent, QWidget* ownerWidget)
 {
-    xEvent.xany.serial = 0; // we are unaware of the last request processed by X Server
-    xEvent.xany.send_event = false;
-    xEvent.xany.display = hostWindow->x11Info().display();
-    // NOTE: event.xany.window doesn't always respond to the .window property of other XEvent's
+    xEvent->xany.serial = 0; // we are unaware of the last request processed by X Server
+    xEvent->xany.send_event = false;
+    xEvent->xany.display = QX11Info::display();
+    // NOTE: event->xany.window doesn't always respond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
-    xEvent.xany.window = hostWindow->window()->handle();
+    xEvent->xany.window = ownerWidget ? ownerWidget->window()->handle() : 0;
 }
 
-void setXKeyEventSpecificFields(XEvent& xEvent, KeyboardEvent* event)
+void PluginView::initXEvent(XEvent* xEvent)
+{
+    memset(xEvent, 0, sizeof(XEvent));
+
+    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+    QWidget* ownerWidget = client ? client->ownerWidget() : 0;
+    setSharedXEventFields(xEvent, ownerWidget);
+}
+
+void setXKeyEventSpecificFields(XEvent* xEvent, KeyboardEvent* event)
 {
     QKeyEvent* qKeyEvent = event->keyEvent()->qtEvent();
 
-    xEvent.xkey.root = QX11Info::appRootWindow();
-    xEvent.xkey.subwindow = 0; // we have no child window
-    xEvent.xkey.time = event->timeStamp();
-    xEvent.xkey.state = qKeyEvent->nativeModifiers();
-    xEvent.xkey.keycode = qKeyEvent->nativeScanCode();
-    xEvent.xkey.same_screen = true;
+    xEvent->type = (event->type() == eventNames().keydownEvent) ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
+    xEvent->xkey.root = QX11Info::appRootWindow();
+    xEvent->xkey.subwindow = 0; // we have no child window
+    xEvent->xkey.time = event->timeStamp();
+    xEvent->xkey.state = qKeyEvent->nativeModifiers();
+    xEvent->xkey.keycode = qKeyEvent->nativeScanCode();
+    xEvent->xkey.same_screen = true;
 
     // NOTE: As the XEvents sent to the plug-in are synthesized and there is not a native window
     // corresponding to the plug-in rectangle, some of the members of the XEvent structures are not
     // set to their normal Xserver values. e.g. Key events don't have a position.
     // source: https://developer.mozilla.org/en/NPEvent
-    xEvent.xkey.x = 0;
-    xEvent.xkey.y = 0;
-    xEvent.xkey.x_root = 0;
-    xEvent.xkey.y_root = 0;
+    xEvent->xkey.x = 0;
+    xEvent->xkey.y = 0;
+    xEvent->xkey.x_root = 0;
+    xEvent->xkey.y_root = 0;
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -207,25 +296,147 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     if (m_isWindowed)
         return;
 
-    if (event->type() != "keydown" && event->type() != "keyup")
+    if (event->type() != eventNames().keydownEvent && event->type() != eventNames().keyupEvent)
         return;
 
-    XEvent npEvent; // On UNIX NPEvent is a typedef for XEvent.
-
-    npEvent.type = (event->type() == "keydown") ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
-    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-    QWidget* window = QWidget::find(client->winId());
-    setSharedXEventFields(npEvent, window);
-    setXKeyEventSpecificFields(npEvent, event);
+    XEvent npEvent;
+    initXEvent(&npEvent);
+    setXKeyEventSpecificFields(&npEvent, event);
 
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 }
 
+static unsigned int inputEventState(MouseEvent* event)
+{
+    unsigned int state = 0;
+    if (event->ctrlKey())
+        state |= ControlMask;
+    if (event->shiftKey())
+        state |= ShiftMask;
+    if (event->altKey())
+        state |= Mod1Mask;
+    if (event->metaKey())
+        state |= Mod4Mask;
+    return state;
+}
+
+static void setXButtonEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XButtonEvent& xbutton = xEvent->xbutton;
+    xbutton.type = event->type() == eventNames().mousedownEvent ? ButtonPress : ButtonRelease;
+    xbutton.root = QX11Info::appRootWindow();
+    xbutton.subwindow = 0;
+    xbutton.time = event->timeStamp();
+    xbutton.x = postZoomPos.x();
+    xbutton.y = postZoomPos.y();
+    xbutton.x_root = event->screenX();
+    xbutton.y_root = event->screenY();
+    xbutton.state = inputEventState(event);
+    switch (event->button()) {
+    case MiddleButton:
+        xbutton.button = Button2;
+        break;
+    case RightButton:
+        xbutton.button = Button3;
+        break;
+    case LeftButton:
+    default:
+        xbutton.button = Button1;
+        break;
+    }
+    xbutton.same_screen = true;
+}
+
+static void setXMotionEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XMotionEvent& xmotion = xEvent->xmotion;
+    xmotion.type = MotionNotify;
+    xmotion.root = QX11Info::appRootWindow();
+    xmotion.subwindow = 0;
+    xmotion.time = event->timeStamp();
+    xmotion.x = postZoomPos.x();
+    xmotion.y = postZoomPos.y();
+    xmotion.x_root = event->screenX();
+    xmotion.y_root = event->screenY();
+    xmotion.state = inputEventState(event);
+    xmotion.is_hint = NotifyNormal;
+    xmotion.same_screen = true;
+}
+
+static void setXCrossingEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XCrossingEvent& xcrossing = xEvent->xcrossing;
+    xcrossing.type = event->type() == eventNames().mouseoverEvent ? EnterNotify : LeaveNotify;
+    xcrossing.root = QX11Info::appRootWindow();
+    xcrossing.subwindow = 0;
+    xcrossing.time = event->timeStamp();
+    xcrossing.x = postZoomPos.y();
+    xcrossing.y = postZoomPos.x();
+    xcrossing.x_root = event->screenX();
+    xcrossing.y_root = event->screenY();
+    xcrossing.state = inputEventState(event);
+    xcrossing.mode = NotifyNormal;
+    xcrossing.detail = NotifyDetailNone;
+    xcrossing.same_screen = true;
+    xcrossing.focus = false;
+}
+
 void PluginView::handleMouseEvent(MouseEvent* event)
 {
     if (m_isWindowed)
         return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+
+    if (event->type() == eventNames().mousedownEvent || event->type() == eventNames().mouseupEvent)
+        setXButtonEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mousemoveEvent)
+        setXMotionEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mouseoverEvent)
+        setXCrossingEventSpecificFields(&npEvent, event, postZoomPos);
+    else
+        return;
+
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleFocusInEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 9; /* int as Qt unsets FocusIn */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
+}
+
+void PluginView::handleFocusOutEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 10; /* int as Qt unsets FocusOut */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
 }
 
 void PluginView::setParent(ScrollView* parent)
@@ -238,7 +449,8 @@ void PluginView::setParent(ScrollView* parent)
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    // Ignored as we don't want to move immediately.
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
 }
 
 void PluginView::setNPWindowIfNeeded()
@@ -246,36 +458,53 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
+    // If the plugin didn't load sucessfully, no point in calling setwindow
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return;
+
     // On Unix, only call plugin if it's full-page or windowed
     if (m_mode != NP_FULL && m_mode != NP_EMBED)
         return;
 
+    // Check if the platformPluginWidget still exists
+    if (m_isWindowed && !platformPluginWidget())
+        return;
+
     if (!m_hasPendingGeometryChange)
         return;
     m_hasPendingGeometryChange = false;
 
-    ASSERT(platformPluginWidget());
-    platformPluginWidget()->setGeometry(m_windowRect);
-    // if setMask is set with an empty QRegion, no clipping will
-    // be performed, so in that case we hide the plugin view
-    platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
-    platformPluginWidget()->setMask(QRegion(m_clipRect));
+    if (m_isWindowed) {
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    } else {
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = 0;
+        m_npWindow.clipRect.bottom = 0;
+    }
 
     // FLASH WORKAROUND: Only set initially. Multiple calls to
-    // setNPWindow() cause the plugin to crash.
-    if (m_npWindow.width == -1 || m_npWindow.height == -1) {
+    // setNPWindow() cause the plugin to crash in windowed mode.
+    if (!m_isWindowed || m_npWindow.width == -1 || m_npWindow.height == -1) {
         m_npWindow.width = m_windowRect.width();
         m_npWindow.height = m_windowRect.height();
     }
 
-    m_npWindow.x = m_windowRect.x();
-    m_npWindow.y = m_windowRect.y();
-
-    m_npWindow.clipRect.left = m_clipRect.x();
-    m_npWindow.clipRect.top = m_clipRect.y();
-    m_npWindow.clipRect.right = m_clipRect.width();
-    m_npWindow.clipRect.bottom = m_clipRect.height();
-
     PluginView::setCurrentPluginView(this);
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
@@ -340,6 +569,10 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
         *static_cast<NPBool*>(value) = true;
         return NPERR_NO_ERROR;
 
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
     default:
         return NPERR_GENERIC_ERROR;
     }
@@ -351,13 +584,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVxDisplay:
-        if (platformPluginWidget())
-            *(void **)value = platformPluginWidget()->x11Info().display();
-        else {
-            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-            QWidget* window = QWidget::find(client->winId());
-            *(void **)value = window->x11Info().display();
-        }
+        *(void **)value = QX11Info::display();
         return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
@@ -402,7 +629,8 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
-        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformPageClient()->winId();
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        *((XID *)w) = client ? client->ownerWidget()->winId() : 0;
         return NPERR_NO_ERROR;
     }
 
@@ -419,7 +647,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
-    if (platformWidget()) {
+    if (m_isWindowed) {
         platformWidget()->update(rect);
         return;
     }
@@ -429,17 +657,88 @@ void PluginView::invalidateRect(const IntRect& rect)
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    notImplemented();
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right + rect->left, rect->bottom + rect->top);
+    invalidateWindowlessPluginRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
 {
-    notImplemented();
+    invalidate();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
+    invalidate();
+}
+
+static Display *getPluginDisplay()
+{
+    // The plugin toolkit might run using a different X connection. At the moment, we only
+    // support gdk based plugins (like flash) that use a different X connection.
+    // The code below has the same effect as this one:
+    // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
+    QLibrary library("libgdk-x11-2.0");
+    if (!library.load())
+        return 0;
+
+    typedef void *(*gdk_display_get_default_ptr)();
+    gdk_display_get_default_ptr gdk_display_get_default = (gdk_display_get_default_ptr)library.resolve("gdk_display_get_default");
+    if (!gdk_display_get_default)
+        return 0;
+
+    typedef void *(*gdk_x11_display_get_xdisplay_ptr)(void *);
+    gdk_x11_display_get_xdisplay_ptr gdk_x11_display_get_xdisplay = (gdk_x11_display_get_xdisplay_ptr)library.resolve("gdk_x11_display_get_xdisplay");
+    if (!gdk_x11_display_get_xdisplay)
+        return 0;
+
+    return (Display*)gdk_x11_display_get_xdisplay(gdk_display_get_default());
+}
+
+static void getVisualAndColormap(int depth, Visual **visual, Colormap *colormap)
+{
+    *visual = 0;
+    *colormap = 0;
+
+#ifndef QT_NO_XRENDER
+    static const bool useXRender = qgetenv("QT_X11_NO_XRENDER").isNull(); // Should also check for XRender >= 0.5
+#else
+    static const bool useXRender = false;
+#endif
+
+    if (!useXRender && depth == 32)
+        return;
+
+    int nvi;
+    XVisualInfo templ;
+    templ.screen  = QX11Info::appScreen();
+    templ.depth   = depth;
+    templ.c_class = TrueColor;
+    XVisualInfo* xvi = XGetVisualInfo(QX11Info::display(), VisualScreenMask | VisualDepthMask | VisualClassMask, &templ, &nvi);
+
+    if (!xvi)
+        return;
+
+#ifndef QT_NO_XRENDER
+    if (depth == 32) {
+        for (int idx = 0; idx < nvi; ++idx) {
+            XRenderPictFormat* format = XRenderFindVisualFormat(QX11Info::display(), xvi[idx].visual);
+            if (format->type == PictTypeDirect && format->direct.alphaMask) {
+                 *visual = xvi[idx].visual;
+                 break;
+            }
+         }
+    } else
+#endif // QT_NO_XRENDER
+        *visual = xvi[0].visual;
+
+    XFree(xvi);
+
+    if (*visual)
+        *colormap = XCreateColormap(QX11Info::display(), QX11Info::appRootWindow(), *visual, AllocNone);
 }
 
 bool PluginView::platformStart()
@@ -456,30 +755,65 @@ bool PluginView::platformStart()
         PluginView::setCurrentPluginView(0);
     }
 
-    if (m_needsXEmbed) {
+    if (m_isWindowed) {
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-        setPlatformWidget(new PluginContainerQt(this, QWidget::find(client->winId())));
+        if (m_needsXEmbed && client) {
+            setPlatformWidget(new PluginContainerQt(this, client->ownerWidget()));
+            // sync our XEmbed container window creation before sending the xid to plugins.
+            QApplication::syncX();
+        } else {
+            notImplemented();
+            m_status = PluginStatusCanNotLoadPlugin;
+            return false;
+        }
     } else {
-        notImplemented();
-        return false;
+        setPlatformWidget(0);
+        m_pluginDisplay = getPluginDisplay();
     }
 
     show();
 
-    NPSetWindowCallbackStruct *wsi = new NPSetWindowCallbackStruct();
-
+    NPSetWindowCallbackStruct* wsi = new NPSetWindowCallbackStruct();
     wsi->type = 0;
 
-    wsi->display = platformPluginWidget()->x11Info().display();
-    wsi->visual = (Visual*)platformPluginWidget()->x11Info().visual();
-    wsi->depth = platformPluginWidget()->x11Info().depth();
-    wsi->colormap = platformPluginWidget()->x11Info().colormap();
-    m_npWindow.ws_info = wsi;
+    if (m_isWindowed) {
+        const QX11Info* x11Info = &platformPluginWidget()->x11Info();
+
+        wsi->display = x11Info->display();
+        wsi->visual = (Visual*)x11Info->visual();
+        wsi->depth = x11Info->depth();
+        wsi->colormap = x11Info->colormap();
+
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget()->winId();
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    } else {
+        const QX11Info* x11Info = &QApplication::desktop()->x11Info();
+
+        if (x11Info->depth() == 32 || !m_plugin->quirks().contains(PluginQuirkRequiresDefaultScreenDepth)) {
+            getVisualAndColormap(32, &m_visual, &m_colormap);
+            wsi->depth = 32;
+        }
+
+        if (!m_visual) {
+            getVisualAndColormap(x11Info->depth(), &m_visual, &m_colormap);
+            wsi->depth = x11Info->depth();
+        }
+
+        wsi->display = x11Info->display();
+        wsi->visual = m_visual;
+        wsi->colormap = m_colormap;
 
-    m_npWindow.type = NPWindowTypeWindow;
-    m_npWindow.window = (void*)platformPluginWidget()->winId();
-    m_npWindow.width = -1;
-    m_npWindow.height = -1;
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    }
+
+    m_npWindow.ws_info = wsi;
 
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))) {
         updatePluginWidget();
@@ -493,6 +827,20 @@ void PluginView::platformDestroy()
 {
     if (platformPluginWidget())
         delete platformPluginWidget();
+
+    if (m_drawable)
+        XFreePixmap(QX11Info::display(), m_drawable);
+
+    if (m_colormap)
+        XFreeColormap(QX11Info::display(), m_colormap);
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
new file mode 100644
index 0000000..aece0e4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
@@ -0,0 +1,77 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "PluginContainerSymbian.h"
+
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PluginView.h"
+
+#include <QApplication>
+#include <QWidget>
+
+using namespace WebCore;
+
+PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent)
+    : m_parent(parent)
+    , m_pluginView(view)
+    , m_hasPendingGeometryChange(false)
+{
+    setParent(m_parent);
+}
+
+PluginContainerSymbian::~PluginContainerSymbian()
+{
+}
+
+void PluginContainerSymbian::requestGeometry(const QRect& rect, const QRegion& clip)
+{
+    if (m_windowRect != rect || m_clipRegion != clip) {
+        m_windowRect = rect;
+        m_clipRegion = clip;
+        m_hasPendingGeometryChange = true;
+    }
+}
+
+void PluginContainerSymbian::adjustGeometry()
+{
+    if (m_hasPendingGeometryChange) {
+        setGeometry(m_windowRect);
+        setMask(m_clipRegion);
+        m_hasPendingGeometryChange = false;
+    }
+}
+
+void PluginContainerSymbian::focusInEvent(QFocusEvent* event)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(true);
+
+    m_pluginView->focusPluginElement();
+}
+
+void PluginContainerSymbian::focusOutEvent(QFocusEvent*)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(false);
+}
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
new file mode 100644
index 0000000..fce4a71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef PluginContainerSymbian_h
+#define PluginContainerSymbian_h
+
+#include <QWidget>
+
+namespace WebCore {
+
+    class PluginView;
+
+    class PluginContainerSymbian : public QWidget {
+        Q_OBJECT
+    public:
+        PluginContainerSymbian(PluginView*, QWidget* parent);
+        ~PluginContainerSymbian();
+
+        void requestGeometry(const QRect&, const QRegion& clip = QRegion());
+        void adjustGeometry();
+
+    protected:
+        virtual void focusInEvent(QFocusEvent*);
+        virtual void focusOutEvent(QFocusEvent*);
+    private:
+        PluginView* m_pluginView;
+        QWidget* m_parent;
+        QRect m_windowRect;
+        QRegion m_clipRegion;
+        bool m_hasPendingGeometryChange;
+    };
+}
+
+#endif // PluginContainerSymbian_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp
new file mode 100644
index 0000000..2e09296
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp
@@ -0,0 +1,79 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginDatabase.h"
+
+#include <QFileInfo>
+#include <f32file.h>
+
+static const char QTPLUGIN_FILTER[] = "*.qtplugin";
+static const char QT_PLUGIN_FOLDER[] = ":\\resource\\qt\\plugins\\npqtplugins\\";
+
+namespace WebCore {
+
+Vector<String> PluginDatabase::defaultPluginDirectories()
+{
+    Vector<String> directories;
+    //find the installation drive
+    TDriveList drivelist;
+    TChar driveLetter;
+    RFs fsSession;
+    
+    if (fsSession.Connect() == KErrNone && fsSession.DriveList(drivelist) == KErrNone) {
+        for (TInt driveNumber = EDriveA; driveNumber <= EDriveZ; driveNumber++) {
+            if (drivelist[driveNumber] && fsSession.DriveToChar(driveNumber, driveLetter) == KErrNone) {
+                QString driveStringValue(QChar((uint)driveLetter.GetUpperCase()));
+                QString stubDirPath;
+                stubDirPath.append(driveStringValue);
+                stubDirPath.append(QT_PLUGIN_FOLDER);
+                if (QFileInfo(stubDirPath).exists())
+                    directories.append(stubDirPath);
+            }
+        }
+    }
+
+    fsSession.Close();
+    return directories;
+}
+
+bool PluginDatabase::isPreferredPluginDirectory(const String& path)
+{
+    return true;
+}
+
+void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
+{
+    // FIXME: This should be a case insensitive set.
+    HashSet<String> uniqueFilenames;
+
+    String fileNameFilter(QTPLUGIN_FILTER);
+
+    Vector<String>::const_iterator dirsEnd = m_pluginDirectories.end();
+    for (Vector<String>::const_iterator dIt = m_pluginDirectories.begin(); dIt != dirsEnd; ++dIt) {
+        Vector<String> pluginPaths = listDirectory(*dIt, fileNameFilter);
+        Vector<String>::const_iterator pluginsEnd = pluginPaths.end();
+        for (Vector<String>::const_iterator pIt = pluginPaths.begin(); pIt != pluginsEnd; ++pIt) {
+            if (!fileExists(*pIt))
+                continue;
+            paths.add(*pIt);
+        }
+    }
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
new file mode 100644
index 0000000..d5c7533
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginPackageSymbian.cpp
@@ -0,0 +1,177 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginPackage.h"
+
+#include "CString.h"
+#include "MIMETypeRegistry.h"
+#include "npinterface.h"
+#include "npruntime_impl.h"
+#include "PluginDatabase.h"
+#include "PluginDebug.h"
+#include <QPluginLoader>
+
+namespace WebCore {
+
+bool PluginPackage::fetchInfo()
+{
+    if (!load())
+        return false;
+
+    char* buf = 0;
+    NPError err = m_pluginFuncs.getvalue(0, NPPVpluginNameString, (void *)&buf);
+    m_name = buf;
+    err = m_pluginFuncs.getvalue(0, NPPVpluginDescriptionString, (void *)&buf);
+    m_description = buf;
+
+    determineModuleVersionFromDescription();
+
+    String s = m_npInterface->NP_GetMIMEDescription();
+    Vector<String> types;
+    s.split(UChar('|'), false, types);  // <MIME1>;<ext1,ext2,ext3,...>;<Description>|<MIME2>|<MIME3>|...
+
+    for (int i = 0; i < types.size(); ++i) {
+        Vector<String> mime;
+        types[i].split(UChar(';'), true, mime);  // <MIME1>;<ext1,ext2,ext3,...>;<Description>
+        if (mime.size() > 0) {
+            Vector<String> exts;
+            if (mime.size() > 1)
+                mime[1].split(UChar(','), false, exts); // <ext1,ext2,ext3,...>
+            
+            m_mimeToExtensions.add(mime[0], exts); // <MIME>,<ext1,ext2,ext3>
+            if (mime.size() > 2)
+                m_mimeToDescriptions.add(mime[0], mime[2]); // <MIME>,<Description>
+        }
+    }
+    unload();
+    return true;
+}
+
+bool PluginPackage::load()
+{
+    if (m_isLoaded) {
+        m_loadCount++;
+        return true;
+    }
+
+    m_pluginLoader = new QPluginLoader(m_path);
+    if (!m_pluginLoader->load()) {
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    QObject* plugin = m_pluginLoader->instance();
+    if (!plugin) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    // Plugin instance created
+    // Cast plugin to NPInterface,
+    m_npInterface = qobject_cast<NPInterface*>(plugin);
+    if (!m_npInterface) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    m_isLoaded = true;
+    
+    NPError npErr;
+    memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
+    m_pluginFuncs.size = sizeof(m_pluginFuncs);
+    m_browserFuncs.size = sizeof(m_browserFuncs);
+    m_browserFuncs.version = NP_VERSION_MINOR;
+    m_browserFuncs.geturl = NPN_GetURL;
+    m_browserFuncs.posturl = NPN_PostURL;
+    m_browserFuncs.requestread = NPN_RequestRead;
+    m_browserFuncs.newstream = NPN_NewStream;
+    m_browserFuncs.write = NPN_Write;
+    m_browserFuncs.destroystream = NPN_DestroyStream;
+    m_browserFuncs.status = NPN_Status;
+    m_browserFuncs.uagent = NPN_UserAgent;
+    m_browserFuncs.memalloc = NPN_MemAlloc;
+    m_browserFuncs.memfree = NPN_MemFree;
+    m_browserFuncs.memflush = NPN_MemFlush;
+    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
+    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
+    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
+    m_browserFuncs.getvalue = NPN_GetValue;
+    m_browserFuncs.setvalue = NPN_SetValue;
+    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
+    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
+    m_browserFuncs.forceredraw = NPN_ForceRedraw;
+    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
+    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
+    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
+    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
+    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
+    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
+    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
+    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
+    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
+    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
+    m_browserFuncs.createobject = _NPN_CreateObject;
+    m_browserFuncs.retainobject = _NPN_RetainObject;
+    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
+    m_browserFuncs.invoke = _NPN_Invoke;
+    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
+    m_browserFuncs.evaluate = _NPN_Evaluate;
+    m_browserFuncs.getproperty = _NPN_GetProperty;
+    m_browserFuncs.setproperty = _NPN_SetProperty;
+    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
+    m_browserFuncs.hasproperty = _NPN_HasMethod;
+    m_browserFuncs.hasmethod = _NPN_HasProperty;
+    m_browserFuncs.setexception = _NPN_SetException;
+    m_browserFuncs.enumerate = _NPN_Enumerate;
+    m_browserFuncs.construct = _NPN_Construct;
+
+    npErr = m_npInterface->NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
+    if (npErr != NPERR_NO_ERROR) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    m_loadCount++;
+    return true;
+}
+
+void PluginPackage::unload()
+{
+    if (!m_isLoaded)
+        return;
+
+    if (--m_loadCount > 0)
+        return;
+        
+    m_isLoaded = false;
+    m_npInterface->NP_Shutdown();
+
+    m_pluginLoader->unload();
+    delete m_pluginLoader;
+    m_pluginLoader = 0;
+}
+}
+
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
new file mode 100644
index 0000000..14e25b1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -0,0 +1,462 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginView.h"
+
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Element.h"
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
+#include "KeyboardEvent.h"
+#include "MouseEvent.h"
+#include "NotImplemented.h"
+#include "npfunctions.h"
+#include "npinterface.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PluginContainerSymbian.h"
+#include "PluginDebug.h"
+#include "PluginMainThreadScheduler.h"
+#include "PluginPackage.h"
+#include "RenderLayer.h"
+#include "ScriptController.h"
+#include "Settings.h"
+#include "npruntime_impl.h"
+#include "runtime.h"
+#include "runtime_root.h"
+#include "QWebPageClient.h"
+#include <QKeyEvent>
+#include <QPixmap.h>
+#include <QRegion>
+#include <QVector>
+#include <QWidget>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
+
+using JSC::ExecState;
+using JSC::Interpreter;
+using JSC::JSLock;
+using JSC::JSObject;
+using JSC::UString;
+
+using namespace std;
+
+using namespace WTF;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void PluginView::updatePluginWidget()
+{
+    if (!parent())
+        return;
+    ASSERT(parent()->isFrameView());
+    FrameView* frameView = static_cast<FrameView*>(parent());
+    IntRect oldWindowRect = m_windowRect;
+    IntRect oldClipRect = m_clipRect;
+    
+    m_windowRect = IntRect(frameView->contentsToWindow(frameRect().location()), frameRect().size());
+    m_clipRect = windowClipRect();
+    m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
+    if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
+        return;
+
+    // in order to move/resize the plugin window at the same time as the rest of frame
+    // during e.g. scrolling, we set the mask and geometry in the paint() function, but
+    // as paint() isn't called when the plugin window is outside the frame which can
+    // be caused by a scroll, we need to move/resize immediately.
+    if (!m_windowRect.intersects(frameView->frameRect()))
+        setNPWindowIfNeeded();
+}
+
+void PluginView::setFocus()
+{
+    if (platformPluginWidget())
+        platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+    else
+        Widget::setFocus();
+}
+
+void PluginView::show()
+{
+    setSelfVisible(true);
+
+    if (isParentVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(true);
+}
+
+void PluginView::hide()
+{
+    setSelfVisible(false);
+
+    if (isParentVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(false);
+}
+
+void PluginView::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!m_isStarted) {
+        paintMissingPluginIcon(context, rect);
+        return;
+    }
+    
+    if (context->paintingDisabled())
+        return;
+    m_npWindow.ws_info = (void*)(context->platformContext());
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed && platformPluginWidget())
+        static_cast<PluginContainerSymbian*>(platformPluginWidget())->adjustGeometry();
+
+    if (m_isWindowed)
+        return;
+
+    context->save();
+    IntRect clipRect(rect);
+    clipRect.intersect(frameRect());
+    context->clip(clipRect);
+    context->translate(frameRect().location().x(), frameRect().location().y());
+
+    QPaintEvent ev(rect);
+    QEvent& npEvent = ev;
+    dispatchNPEvent(npEvent);
+
+    context->restore();
+}
+
+// TODO: Unify across ports.
+bool PluginView::dispatchNPEvent(NPEvent& event)
+{
+    if (!m_plugin->pluginFuncs()->event)
+        return false;
+
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+
+    setCallingPlugin(true);
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+
+    return accepted;
+}
+
+void PluginView::handleKeyboardEvent(KeyboardEvent* event)
+{
+    if (m_isWindowed)
+        return;
+
+    QEvent& npEvent = *(event->keyEvent()->qtEvent());
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleMouseEvent(MouseEvent* event)
+{
+    if (m_isWindowed)
+        return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    QEvent::Type type;
+    if (event->type() == eventNames().mousedownEvent)
+        type = QEvent::MouseButtonPress;
+    else if (event->type() == eventNames().mousemoveEvent)
+        type = QEvent::MouseMove;
+    else if (event->type() == eventNames().mouseupEvent)
+        type = QEvent::MouseButtonRelease;
+    else
+        return;
+
+    QPoint position(event->offsetX(), event->offsetY());
+    Qt::MouseButton button;
+    switch (event->which()) {
+    case 1:
+        button = Qt::LeftButton;
+        break;
+    case 2:
+        button = Qt::MidButton;
+        break;
+    case 3:
+        button = Qt::RightButton;
+        break;
+    default:
+        button = Qt::NoButton;
+    }
+    Qt::KeyboardModifiers modifiers = 0;
+    if (event->ctrlKey())
+        modifiers |= Qt::ControlModifier;
+    if (event->altKey())
+        modifiers |= Qt::AltModifier;
+    if (event->shiftKey())
+        modifiers |= Qt::ShiftModifier;
+    if (event->metaKey())
+        modifiers |= Qt::MetaModifier;
+    QMouseEvent mouseEvent(type, position, button, button, modifiers); 
+    QEvent& npEvent = mouseEvent;
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::setParent(ScrollView* parent)
+{
+    Widget::setParent(parent);
+
+    if (parent)
+        init();
+}
+
+void PluginView::setNPWindowRect(const IntRect&)
+{
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
+}
+
+void PluginView::setNPWindowIfNeeded()
+{
+    if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
+        return;
+    if (m_isWindowed) {
+        ASSERT(platformPluginWidget());
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    
+    } else {
+        // always call this method before painting.
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+    
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = m_windowRect.width();
+        m_npWindow.clipRect.bottom = m_windowRect.height();
+        m_npWindow.window = 0;
+    }
+
+    m_npWindow.width = m_windowRect.width();
+    m_npWindow.height = m_windowRect.height();
+    if (m_npWindow.x < 0 || m_npWindow.y < 0 || m_npWindow.width <= 0 || m_npWindow.height <= 0)
+        return;
+    
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    setCallingPlugin(true);
+    m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+}
+
+void PluginView::setParentVisible(bool visible)
+{
+    if (isParentVisible() == visible)
+        return;
+
+    Widget::setParentVisible(visible);
+
+    if (isSelfVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(visible);
+}
+
+NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const char* buf)
+{
+    notImplemented();
+    return NPERR_NO_ERROR;
+}
+
+NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
+
+    switch (variable) {
+    case NPNVjavascriptEnabledBool:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
+    default:
+        return NPERR_GENERIC_ERROR;
+    }
+}
+
+NPError PluginView::getValue(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
+
+    switch (variable) {
+    case NPNVWindowNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (windowScriptObject)
+            _NPN_RetainObject(windowScriptObject);
+
+        void** v = (void**)value;
+        *v = windowScriptObject;
+            
+        return NPERR_NO_ERROR;
+    }
+
+    case NPNVPluginElementNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* pluginScriptObject = 0;
+
+        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
+            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (pluginScriptObject)
+            _NPN_RetainObject(pluginScriptObject);
+
+        void** v = (void**)value;
+        *v = pluginScriptObject;
+
+        return NPERR_NO_ERROR;
+    }        
+    default:
+        return getValueStatic(variable, value);
+    }
+}
+
+void PluginView::invalidateRect(const IntRect& rect)
+{
+    if (m_isWindowed) {
+        platformWidget()->update(rect);
+        return;
+    }
+    
+    invalidateWindowlessPluginRect(rect);
+}
+    
+void PluginView::invalidateRect(NPRect* rect)
+{
+    if (m_isWindowed)
+        return;
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
+    m_invalidRects.append(r);
+    if (!m_invalidateTimer.isActive())
+        m_invalidateTimer.startOneShot(0.001);
+}
+
+void PluginView::invalidateRegion(NPRegion region)
+{
+    if (m_isWindowed)
+        return;
+    
+    if (!region) 
+        return;
+    
+    QVector<QRect> rects = region->rects();
+    for (int i = 0; i < rects.size(); ++i) {
+        const QRect& qRect = rects.at(i);
+        m_invalidRects.append(qRect);
+        if (!m_invalidateTimer.isActive())
+            m_invalidateTimer.startOneShot(0.001);
+    }
+}
+
+void PluginView::forceRedraw()
+{
+    if (m_isWindowed)
+        return;
+    invalidate();
+}
+
+bool PluginView::platformStart()
+{
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
+    
+    show();
+
+    if (m_isWindowed) {
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        // FIXME this will not work for QGraphicsView.
+        // But we cannot use winId because it will create a window and on S60,
+        // QWidgets should not create a window. 
+        Q_ASSERT(qobject_cast<QWidget*>(client->pluginParent()));
+        setPlatformWidget(new PluginContainerSymbian(this, 
+            qobject_cast<QWidget*>(client->pluginParent())));
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget();
+
+    } else {
+        setPlatformWidget(0);
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+    }    
+    setNPWindowIfNeeded();
+    
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    delete platformPluginWidget();
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/npinterface.h b/src/3rdparty/webkit/WebCore/plugins/symbian/npinterface.h
new file mode 100644
index 0000000..0f0b6ca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/npinterface.h
@@ -0,0 +1,37 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef npinterface_H
+#define npinterface_H
+
+#include "npfunctions.h"
+#include <QtPlugin>
+
+class NPInterface {
+public:
+    virtual NPError NP_Initialize(NPNetscapeFuncs* aNPNFuncs, NPPluginFuncs* aNPPFuncs) = 0;
+    virtual void NP_Shutdown() = 0;
+    virtual char* NP_GetMIMEDescription() = 0;
+};
+
+
+QT_BEGIN_NAMESPACE
+Q_DECLARE_INTERFACE(NPInterface, "com.nokia.qts60.webplugin/1.0");
+QT_END_NAMESPACE
+
+#endif // npinterface_H
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index 21ac2a4..e1bf8d6 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -29,6 +29,7 @@
 
 #include "PluginView.h"
 
+#include "BitmapImage.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -52,6 +53,7 @@
 #include "PluginMessageThrottlerWin.h"
 #include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
+#include "RenderWidget.h"
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "PluginDatabase.h"
@@ -75,6 +77,7 @@
 
 #if PLATFORM(QT)
 #include "QWebPageClient.h"
+#include <QWidget>
 #endif
 
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
@@ -82,7 +85,7 @@ static inline HWND windowHandleForPageClient(PlatformPageClient client)
 #if PLATFORM(QT)
     if (!client)
         return 0;
-    return client->winId();
+    return client->ownerWidget()->winId();
 #else
     return client;
 #endif
@@ -1008,8 +1011,42 @@ bool PluginView::platformStart()
 
 void PluginView::platformDestroy()
 {
-    if (platformPluginWidget())
-        DestroyWindow(platformPluginWidget());
+    if (!platformPluginWidget())
+        return;
+
+    DestroyWindow(platformPluginWidget());
+    setPlatformPluginWidget(0);
+}
+
+void PluginView::halt()
+{
+    ASSERT(!m_isHalted);
+    ASSERT(m_isStarted);
+
+#if !PLATFORM(QT)
+    // Show a screenshot of the plug-in.
+    OwnPtr<HBITMAP> nodeImage(m_parentFrame->nodeImage(m_element));
+    toRenderWidget(m_element->renderer())->showSubstituteImage(BitmapImage::create(nodeImage.get()));
+#endif
+
+    m_isHalted = true;
+    m_hasBeenHalted = true;
+
+    stop();
+    platformDestroy();
+}
+
+void PluginView::restart()
+{
+    ASSERT(!m_isStarted);
+    ASSERT(m_isHalted);
+
+    // Clear any substitute image.
+    toRenderWidget(m_element->renderer())->showSubstituteImage(0);
+
+    m_isHalted = false;
+    m_haveUpdatedPluginWidget = false;
+    start();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
index 22a11b9..f546abb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
@@ -63,11 +63,17 @@ void CounterNode::recount()
     for (CounterNode* c = this; c; c = c->m_nextSibling) {
         int oldCount = c->m_countInParent;
         int newCount = c->computeCountInParent();
-        c->m_countInParent = newCount;
         if (oldCount == newCount)
             break;
-        if (c->m_renderer->isCounter())
-            c->m_renderer->setNeedsLayoutAndPrefWidthsRecalc();
+        c->m_countInParent = newCount;
+        // m_renderer contains the parent of the render node
+        // corresponding to a CounterNode. Let's find the counter
+        // child and make this re-layout.
+        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
+            if (!o->documentBeingDestroyed() && o->isCounter()) {
+                o->setNeedsLayoutAndPrefWidthsRecalc();
+                break;
+            }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index 599129b..baea956 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -429,7 +429,7 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                 }
                 lineHeight = baseline + baselineToBottom;
             } else if (parentLineHeight.isPercent()) {
-                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize());
+                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize(), true);
                 baseline = 0;
                 for (size_t i = 0; i < usedFonts.size(); ++i) {
                     int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
@@ -578,28 +578,23 @@ void InlineFlowBox::computeVerticalOverflow(int lineTop, int lineBottom, bool st
             
             topVisualOverflow = min(curr->y() + childOverflowTop, topVisualOverflow);
             bottomVisualOverflow = max(curr->y() + text->height() + childOverflowBottom, bottomVisualOverflow);
-        } else {
-            // Only include overflow from inline flows and replaced inlines if they do not paint themselves.
-            bool childIsSelfPainting = curr->boxModelObject()->hasSelfPaintingLayer();
-            if (curr->renderer()->isRenderInline()) {
-                InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
-                flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
-                if (!childIsSelfPainting) {
-                    topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
-                    bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
-                    topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
-                    bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
-                }
-            } else if (!childIsSelfPainting){
-                RenderBox* box = toRenderBox(curr->renderer());
-                int boxY = curr->y();
-                int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
-                int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
-                topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
-                bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
-                topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
-                bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
-            }
+        } else  if (curr->renderer()->isRenderInline()) {
+            InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
+            flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
+            topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
+            bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
+            topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
+            bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
+        } else if (!curr->boxModelObject()->hasSelfPaintingLayer()){
+            // Only include overflow from replaced inlines if they do not paint themselves.
+            RenderBox* box = toRenderBox(curr->renderer());
+            int boxY = curr->y();
+            int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
+            int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
+            topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
+            bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
+            topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
+            bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
         }
     }
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index 29e2e57..73b9a3a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -46,6 +46,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+HTMLMediaElement* toParentMediaElement(RenderObject* o)
+{
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+
 // FIXME: These constants may need to be tweaked to better match the seeking in the QuickTime plug-in.
 static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
@@ -138,7 +148,7 @@ bool MediaControlElement::rendererIsNeeded(RenderStyle* style)
     ASSERT(document()->page());
 
     return HTMLDivElement::rendererIsNeeded(style) && parent() && parent()->renderer()
-        && document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement);
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
     
 void MediaControlElement::attach()
@@ -366,7 +376,7 @@ bool MediaControlInputElement::rendererIsNeeded(RenderStyle* style)
     ASSERT(document()->page());
 
     return HTMLInputElement::rendererIsNeeded(style) && parent() && parent()->renderer()
-        && document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement);
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
 
 void MediaControlInputElement::attach()
@@ -646,12 +656,12 @@ MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Documen
 void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
 {
     if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->enterFullscreen();
         event->setDefaultHandled();
     }
     HTMLInputElement::defaultEventHandler(event);
 }
 
-
 // ----------------------------
 
 MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, PseudoId pseudo, HTMLMediaElement* element)
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index f692485..e562bb5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -66,6 +66,8 @@ enum MediaControlElementType {
     MediaVolumeSliderThumb
 };
 
+HTMLMediaElement* toParentMediaElement(RenderObject*);
+
 class MediaControlShadowRootElement : public HTMLDivElement {
 public:
     MediaControlShadowRootElement(Document*, HTMLMediaElement*);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
index f407099..e05c8b4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBR.cpp
@@ -64,7 +64,7 @@ int RenderBR::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
             return s->font().lineSpacing();
         }
         if (lh.isPercent())
-            return lh.calcMinValue(s->fontSize());
+            return lh.calcMinValue(s->fontSize(), true);
         return lh.value();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
index ae0d76d..237478d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
@@ -774,7 +774,9 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // Repaint with our new bounds if they are different from our old bounds.
     bool didFullRepaint = repainter.repaintAfterLayout();
     if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
-        IntRect repaintRect(leftVisibleOverflow(), repaintTop, rightVisibleOverflow() - leftVisibleOverflow(), repaintBottom - repaintTop);
+        int repaintLeft = min(leftVisualOverflow(), leftLayoutOverflow());
+        int repaintRight = max(rightVisualOverflow(), rightLayoutOverflow());
+        IntRect repaintRect(repaintLeft, repaintTop, repaintRight - repaintLeft, repaintBottom - repaintTop);
 
         // FIXME: Deal with multiple column repainting.  We have to split the repaint
         // rect up into multiple rects if it spans columns.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index c8d3037..1df82a4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -139,6 +139,8 @@ void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyl
             markContainingBlocksForLayout();
             if (style()->position() == StaticPosition)
                 repaint();
+            else if (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition)
+                parent()->setChildNeedsLayout(true);
             if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
                 removeFloatingOrPositionedChildFromBlockLists();
         }
@@ -961,10 +963,10 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
         transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 
     if (containerSkipped) {
-        // There can't be a transfrom between repaintContainer and o, because transforms create containers, so it should be safe
+        // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
         // to just subtract the delta between the repaintContainer and o.
-        IntSize repaintContainerOffset = repaintContainer->offsetFromContainer(o);
-        transformState.move(-repaintContainerOffset.width(), -repaintContainerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
         return;
     }
     
@@ -1201,7 +1203,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, In
 
     if (containerSkipped) {
         // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
-        IntSize containerOffset = repaintContainer->offsetFromContainer(o);
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
         rect.move(-containerOffset);
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
index 67e5cba..17c6dad 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
@@ -143,13 +143,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
     RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
     RenderObject* prevCounterCandidate = object;
     CounterNode* candidateCounter = 0;
+    // When a reset counter is chosen as candidateCounter, we'll
+    // decide the new node should be a child of the reset node or a
+    // sibling or the reset node. This flag controls it.
+    bool createChildForReset = true;
     while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
         CounterNode* c = counter(prevCounterCandidate, counterName, false);
         if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter)
+            if (!candidateCounter) {
                 candidateCounter = c;
+                createChildForReset = true;
+            }
             if (candidateCounter) {
-                if (candidateCounter->isReset()) {
+                if (createChildForReset && candidateCounter->isReset()) {
                     parent = candidateCounter;
                     previousSibling = 0;
                 } else {
@@ -160,10 +166,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
             }
             resetCandidate = previousSiblingOrParent(resetCandidate);
         } else if (c) {
-            if (c->isReset())
-                candidateCounter = 0;
-            else if (!candidateCounter)
+            if (c->isReset()) {
+                if (c->parent()) {
+                    // The new node may be the next sibling of this reset node.
+                    createChildForReset = false;
+                    candidateCounter = c;
+                } else {
+                    createChildForReset = true;
+                    candidateCounter = 0;
+                }
+            } else if (!candidateCounter) {
+                createChildForReset = true;
                 candidateCounter = c;
+            }
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index 51c3073..4206b1c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -227,7 +227,7 @@ bool RenderImage::setImageSizeForAltText(CachedImage* newImage /* = 0 */)
         imageHeight = paddingHeight;
     }
   
-    if (newImage) {
+    if (newImage && newImage->image()) {
         // imageSize() returns 0 for the error image.  We need the true size of the
         // error image, so we have to get it by grabbing image() directly.
         imageWidth += newImage->image()->width() * style()->effectiveZoom();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index a5e973e..05d29d0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -697,7 +697,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
 
     if (containerSkipped) {
         // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
-        IntSize containerOffset = repaintContainer->offsetFromContainer(o);
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
         rect.move(-containerOffset);
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index 95db43a..fea61c9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -311,12 +311,19 @@ void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
     if (m_reflection)
         m_reflection->layout();
 
+#if USE(ACCELERATED_COMPOSITING)
+    // Clear the IsCompositingUpdateRoot flag once we've found the first compositing layer in this update.
+    bool isUpdateRoot = (flags & IsCompositingUpdateRoot);
+    if (isComposited())
+        flags &= ~IsCompositingUpdateRoot;
+#endif
+
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
         child->updateLayerPositions(flags);
 
 #if USE(ACCELERATED_COMPOSITING)
     if ((flags & UpdateCompositingLayers) && isComposited())
-        backing()->updateAfterLayout(RenderLayerBacking::CompositingChildren);
+        backing()->updateAfterLayout(RenderLayerBacking::CompositingChildren, isUpdateRoot);
 #endif
         
     // With all our children positioned, now update our marquee if we need to.
@@ -662,21 +669,20 @@ RenderLayer* RenderLayer::enclosingTransformedAncestor() const
     return curr;
 }
 
+static inline const RenderLayer* compositingContainer(const RenderLayer* layer)
+{
+    return layer->isNormalFlowOnly() ? layer->parent() : layer->stackingContext();
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 {
     if (includeSelf && isComposited())
         return const_cast<RenderLayer*>(this);
 
-    // Compositing layers are parented according to stacking order and overflow list,
-    // so we have to check whether the parent is a stacking context, or whether 
-    // the child is overflow-only.
-    bool inNormalFlowList = isNormalFlowOnly();
-    for (RenderLayer* curr = parent(); curr; curr = curr->parent()) {
-        if (curr->isComposited() && (inNormalFlowList || curr->isStackingContext()))
-            return curr;
-        
-        inNormalFlowList = curr->isNormalFlowOnly();
+    for (const RenderLayer* curr = compositingContainer(this); curr; curr = compositingContainer(curr)) {
+        if (curr->isComposited())
+            return const_cast<RenderLayer*>(curr);
     }
          
     return 0;
@@ -1140,8 +1146,10 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
 
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode()) {
-        if (RenderLayer* compositingAncestor = ancestorCompositingLayer())
-            compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants);
+        if (RenderLayer* compositingAncestor = ancestorCompositingLayer()) {
+            bool isUpdateRoot = true;
+            compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants, isUpdateRoot);
+        }
     }
 #endif
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index 9d2212b..a274638 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -298,10 +298,11 @@ public:
     enum UpdateLayerPositionsFlag {
         DoFullRepaint = 1,
         CheckForRepaint = 1 << 1,
-        UpdateCompositingLayers = 1 << 2,
+        IsCompositingUpdateRoot = 1 << 2,
+        UpdateCompositingLayers = 1 << 3,
     };
     typedef unsigned UpdateLayerPositionsFlags;
-    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | UpdateCompositingLayers);
+    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers);
 
     void updateTransform();
 
@@ -327,6 +328,7 @@ public:
     Vector<RenderLayer*>* normalFlowList() const { return m_normalFlowList; }
 
     bool hasVisibleContent() const { return m_hasVisibleContent; }
+    bool hasVisibleDescendant() const { return m_hasVisibleDescendant; }
     void setHasVisibleContent(bool);
     void dirtyVisibleContentStatus();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index 941817c..d7248d4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -89,8 +89,8 @@ void RenderLayerBacking::createGraphicsLayer()
         m_graphicsLayer->setName("Anonymous Node");
 #endif  // NDEBUG
 
-    updateLayerOpacity();
-    updateLayerTransform();
+    updateLayerOpacity(renderer()->style());
+    updateLayerTransform(renderer()->style());
 }
 
 void RenderLayerBacking::destroyGraphicsLayer()
@@ -104,15 +104,13 @@ void RenderLayerBacking::destroyGraphicsLayer()
     m_maskLayer = 0;
 }
 
-void RenderLayerBacking::updateLayerOpacity()
+void RenderLayerBacking::updateLayerOpacity(const RenderStyle* style)
 {
-    m_graphicsLayer->setOpacity(compositingOpacity(renderer()->opacity()));
+    m_graphicsLayer->setOpacity(compositingOpacity(style->opacity()));
 }
 
-void RenderLayerBacking::updateLayerTransform()
+void RenderLayerBacking::updateLayerTransform(const RenderStyle* style)
 {
-    RenderStyle* style = renderer()->style();
-
     // FIXME: This could use m_owningLayer->transform(), but that currently has transform-origin
     // baked into it, and we don't want that.
     TransformationMatrix t;
@@ -148,7 +146,7 @@ void RenderLayerBacking::updateCompositedBounds()
     setCompositedBounds(layerBounds);
 }
 
-void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
+void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth, bool isUpdateRoot)
 {
     RenderLayerCompositor* layerCompositor = compositor();
     if (!layerCompositor->compositingLayersNeedRebuild()) {
@@ -162,7 +160,7 @@ void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
         updateCompositedBounds();
         layerCompositor->updateCompositingDescendantGeometry(m_owningLayer, m_owningLayer, updateDepth);
         
-        if (!m_owningLayer->parent()) {
+        if (isUpdateRoot) {
             updateGraphicsLayerGeometry();
             layerCompositor->updateRootLayerPosition();
         }
@@ -219,11 +217,11 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     // Set transform property, if it is not animating. We have to do this here because the transform
     // is affected by the layer dimensions.
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyWebkitTransform))
-        updateLayerTransform();
+        updateLayerTransform(renderer()->style());
 
     // Set opacity, if it is not animating.
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyOpacity))
-        updateLayerOpacity();
+        updateLayerOpacity(renderer()->style());
     
     RenderStyle* style = renderer()->style();
     m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
@@ -886,7 +884,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
-    bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
+    bool shouldPaint = (m_owningLayer->hasVisibleContent() || m_owningLayer->hasVisibleDescendant()) && m_owningLayer->isSelfPaintingLayer();
 
     if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
         // If this is the root then we need to send in a bigger bounding box
@@ -1082,8 +1080,11 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
             // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
-            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime))
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime)) {
+                // To ensure that the correct opacity is visible when the animation ends, also set the final opacity.
+                updateLayerOpacity(toStyle);
                 didAnimate = true;
+            }
         }
     }
 
@@ -1093,8 +1094,11 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
             transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
             transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
-            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime))
+            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime)) {
+                // To ensure that the correct transform is visible when the animation ends, also set the final opacity.
+                updateLayerTransform(toStyle);
                 didAnimate = true;
+            }
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
index e12aa58..17bcaf7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
@@ -54,7 +54,7 @@ public:
     RenderLayer* owningLayer() const { return m_owningLayer; }
 
     enum UpdateDepth { CompositingChildren, AllDescendants };
-    void updateAfterLayout(UpdateDepth);
+    void updateAfterLayout(UpdateDepth, bool isUpdateRoot);
     
     // Returns true if layer configuration changed.
     bool updateGraphicsLayerConfiguration();
@@ -140,8 +140,8 @@ private:
     // Result is perspective origin in pixels.
     FloatPoint computePerspectiveOrigin(const IntRect& borderBox) const;
 
-    void updateLayerOpacity();
-    void updateLayerTransform();
+    void updateLayerOpacity(const RenderStyle*);
+    void updateLayerTransform(const RenderStyle*);
 
     // Return the opacity value that this layer should use for compositing.
     float compositingOpacity(float rendererOpacity) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index bcd1f08..5201287 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -535,6 +535,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
 void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
 {
+    ASSERT(!parentLayer || childLayer->ancestorCompositingLayer() == parentLayer);
     ASSERT(childLayer->isComposited());
 
     // It's possible to be called with a parent that isn't yet composited when we're doing
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
index f94f7ce..0edfdef 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.cpp
@@ -508,7 +508,7 @@ bool RenderListBox::listIndexIsVisible(int index)
     return index >= m_indexOffset && index < m_indexOffset + numVisibleItems();
 }
 
-bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node**)
 {
     return m_vBar && m_vBar->scroll(direction, granularity, multiplier);
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
index e5454e5..aafb87e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
@@ -68,7 +68,7 @@ private:
 
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     virtual void calcPrefWidths();
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
index 0ce0642..9cc1493 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
@@ -37,7 +37,7 @@ using namespace std;
  
 namespace WebCore {
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
@@ -82,16 +82,6 @@ void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
     o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
 }
 
-static HTMLMediaElement* parentMediaElement(RenderObject* o)
-{
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
 bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
@@ -121,7 +111,7 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
             paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
         case MediaSlider: {
-            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+            if (HTMLMediaElement* mediaElement = toParentMediaElement(o))
                 STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, mediaElement->percentLoaded());
             break;
         }
@@ -159,4 +149,3 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
 #endif  // #if ENABLE(VIDEO)
 
 } // namespace WebCore
-
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
new file mode 100644
index 0000000..ed20ecf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -0,0 +1,287 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderMediaControlsChromium.h"
+
+#include "Gradient.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+#if ENABLE(VIDEO)
+
+typedef WTF::HashMap<const char*, Image*> MediaControlImageMap;
+static MediaControlImageMap* gMediaControlImageMap = 0;
+
+static Image* platformResource(const char* name)
+{
+    if (!gMediaControlImageMap)
+        gMediaControlImageMap = new MediaControlImageMap();
+    if (Image* image = gMediaControlImageMap->get(name))
+        return image;
+    if (Image* image = Image::loadPlatformResource(name).releaseRef()) {
+        gMediaControlImageMap->set(name, image);
+        return image;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    IntRect imageRect = image->rect();
+    context->drawImage(image, rect);
+    return true;
+}
+
+static bool paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+      return false;
+
+    static Image* soundFull = platformResource("mediaSoundFull");
+    static Image* soundNone = platformResource("mediaSoundNone");
+    static Image* soundDisabled = platformResource("mediaSoundDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+        return paintMediaButton(paintInfo.context, rect, soundDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+}
+
+static bool paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = platformResource("mediaPlay");
+    static Image* mediaPause = platformResource("mediaPause");
+    static Image* mediaPlayDisabled = platformResource("mediaPlayDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_EMPTY ||
+        mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+        return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+}
+
+static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    RenderStyle* style = object->style();
+    GraphicsContext* context = paintInfo.context;
+
+    // Draw the border of the time bar.
+    // FIXME: this should be a rounded rect but need to fix GraphicsContextSkia first.
+    // https://bugs.webkit.org/show_bug.cgi?id=30143
+    context->save();
+    context->setShouldAntialias(true);
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeThickness(style->borderLeftWidth());
+    context->setFillColor(style->backgroundColor());
+    context->drawRect(rect);
+    context->restore();
+
+    // Draw the buffered ranges.
+    // FIXME: Draw multiple ranges if there are multiple buffered ranges.
+    IntRect bufferedRect = rect;
+    bufferedRect.inflate(-style->borderLeftWidth());
+    bufferedRect.setWidth((bufferedRect.width() * mediaElement->percentLoaded()));
+
+    // Don't bother drawing an empty area.
+    if (!bufferedRect.isEmpty()) {
+        IntPoint sliderTopLeft = bufferedRect.location();
+        IntPoint sliderTopRight = sliderTopLeft;
+        sliderTopRight.move(0, bufferedRect.height());
+
+        RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderTopRight);
+        Color startColor = object->style()->color();
+        gradient->addColorStop(0.0, startColor);
+        gradient->addColorStop(1.0, Color(startColor.red() / 2, startColor.green() / 2, startColor.blue() / 2, startColor.alpha()));
+
+        context->save();
+        context->setStrokeStyle(NoStroke);
+        context->setFillGradient(gradient);
+        context->fillRect(bufferedRect);
+        context->restore();
+    }
+
+    return true;
+}
+
+static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
+}
+
+static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    GraphicsContext* context = paintInfo.context;
+    Color originalColor = context->strokeColor();
+    if (originalColor != Color::white)
+        context->setStrokeColor(Color::white);
+
+    int x = rect.x() + rect.width() / 2;
+    context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
+
+    if (originalColor != Color::white)
+        context->setStrokeColor(originalColor);
+    return true;
+}
+
+static bool paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaVolumeSliderThumb);
+}
+
+static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    if (!rect.isEmpty()) {
+        GraphicsContext* context = paintInfo.context;
+        Color originalColor = context->strokeColor();
+        float originalThickness = context->strokeThickness();
+        StrokeStyle originalStyle = context->strokeStyle();
+
+        context->setStrokeStyle(SolidStroke);
+
+        // Draw the left border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderLeftWidth());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->drawLine(IntPoint(rect.x() + 1, rect.y()),
+                          IntPoint(rect.x() + 1, rect.y() + rect.height()));
+
+        // Draw the right border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderRightWidth());
+        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
+                          IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
+
+        context->setStrokeColor(originalColor);
+        context->setStrokeThickness(originalThickness);
+        context->setStrokeStyle(originalStyle);
+    }
+    return true;
+}
+
+bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    UNUSED_PARAM(e);
+
+    switch (part) {
+    case MediaMuteButtonPart:
+    case MediaPlayButtonPart:
+    case MediaSliderPart:
+    case MediaSliderThumbPart:
+    case MediaVolumeSliderContainerPart:
+    case MediaVolumeSliderPart:
+    case MediaVolumeSliderThumbPart:
+    case MediaControlsBackgroundPart:
+    case MediaCurrentTimePart:
+    case MediaTimeRemainingPart:
+        return true;
+    }
+    return false;
+}
+
+bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    switch (part) {
+    case MediaMuteButton:
+    case MediaUnMuteButton:
+        return paintMediaMuteButton(object, paintInfo, rect);
+    case MediaPauseButton:
+    case MediaPlayButton:
+        return paintMediaPlayButton(object, paintInfo, rect);
+    case MediaSlider:
+        return paintMediaSlider(object, paintInfo, rect);
+    case MediaSliderThumb:
+        return paintMediaSliderThumb(object, paintInfo, rect);
+    case MediaVolumeSlider:
+        return paintMediaVolumeSlider(object, paintInfo, rect);
+    case MediaVolumeSliderThumb:
+        return paintMediaVolumeSliderThumb(object, paintInfo, rect);
+    case MediaTimelineContainer:
+        return paintMediaTimelineContainer(object, paintInfo, rect);
+    case MediaFullscreenButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaVolumeSliderContainer:
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+    case MediaControlsPanel:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    return false;
+}
+
+void RenderMediaControlsChromium::adjustMediaSliderThumbSize(RenderObject* object)
+{
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+
+    Image* thumbImage = 0;
+    if (object->style()->appearance() == MediaSliderThumbPart)
+        thumbImage = mediaSliderThumb;
+    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
+        thumbImage = mediaVolumeSliderThumb;
+
+    float zoomLevel = object->style()->effectiveZoom();
+    if (thumbImage) {
+        object->style()->setWidth(Length(static_cast<int>(thumbImage->width() * zoomLevel), Fixed));
+        object->style()->setHeight(Length(static_cast<int>(thumbImage->height() * zoomLevel), Fixed));
+    }
+}
+
+#endif  // #if ENABLE(VIDEO)
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.h b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.h
new file mode 100644
index 0000000..d6d986c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControlsChromium.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMediaControlsChromium_h
+#define RenderMediaControlsChromium_h
+
+#include "RenderObject.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+class HTMLMediaElement;
+class RenderMediaControlsChromium {
+public:
+    static bool shouldRenderMediaControlPart(ControlPart, Element*);
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static void adjustMediaSliderThumbSize(RenderObject*);
+};
+
+} // namespace WebCore
+
+#endif // RenderMediaControlsChromium_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index b7f59e1..a10ffd9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -1568,7 +1568,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             // For changes in float styles, we need to conceivably remove ourselves
             // from the floating objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
-        else if (isPositioned() && (newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition))
+        else if (isPositioned() && (m_style->position() != newStyle->position()))
             // For changes in positioning styles, we need to conceivably remove ourselves
             // from the positioned objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
@@ -1755,6 +1755,23 @@ IntSize RenderObject::offsetFromContainer(RenderObject* o) const
     return offset;
 }
 
+IntSize RenderObject::offsetFromAncestorContainer(RenderObject* container) const
+{
+    IntSize offset;
+    const RenderObject* currContainer = this;
+    do {
+        RenderObject* nextContainer = currContainer->container();
+        ASSERT(nextContainer);  // This means we reached the top without finding container.
+        if (!nextContainer)
+            break;
+        ASSERT(!currContainer->hasTransform());
+        offset += currContainer->offsetFromContainer(nextContainer);
+        currContainer = nextContainer;
+    } while (currContainer != container);
+
+    return offset;
+}
+
 IntRect RenderObject::localCaretRect(InlineBox*, int, int* extraWidthToEndOfLine)
 {
     if (extraWidthToEndOfLine)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index 367eaa6..e358c98 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -541,6 +541,8 @@ public:
 
     // Return the offset from the container() renderer (excluding transforms)
     virtual IntSize offsetFromContainer(RenderObject*) const;
+    // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
+    IntSize offsetFromAncestorContainer(RenderObject*) const;
     
     virtual void absoluteRects(Vector<IntRect>&, int, int) { }
     // FIXME: useTransforms should go away eventually
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index 199c0da..e2c8e7d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -249,7 +249,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
                 return;
         }
 
-        bool success = frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        bool success = o->dispatchBeforeLoadEvent(url) &&
+                       frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
         if (!success && m_hasFallbackContent)
             o->renderFallbackContent();
     } else if (node()->hasTagName(embedTag)) {
@@ -283,7 +284,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         }
 
-        frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
     }
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
     else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
@@ -306,7 +308,9 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         }
 
         serviceType = "application/x-media-element-proxy-plugin";
-        frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+        
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
     }
 #endif
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
index 247acda..442af39 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
@@ -50,7 +50,7 @@ static const int defaultTrackLength = 129;
 struct SliderRange {
     bool isIntegral;
     double minimum;
-    double maximum;
+    double maximum;  // maximum must be >= minimum.
 
     explicit SliderRange(HTMLInputElement*);
     double clampValue(double value);
@@ -80,12 +80,8 @@ SliderRange::SliderRange(HTMLInputElement* element)
 
     isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
 
-    // FIXME: This treats maximum strings that can't be parsed as 0, but perhaps 100 would be more appropriate.
-    const AtomicString& maxString = element->getAttribute(maxAttr);
-    maximum = maxString.isNull() ? 100.0 : maxString.toDouble();
-
-    // If the maximum is smaller, use it as the minimum.
-    minimum = min(element->getAttribute(minAttr).toDouble(), maximum);
+    maximum = element->rangeMaximum();
+    minimum = element->rangeMinimum();
 }
 
 double SliderRange::clampValue(double value)
@@ -96,12 +92,14 @@ double SliderRange::clampValue(double value)
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
 {
-    String valueString = element->value();
-    double oldValue = valueString.isNull() ? (minimum + maximum) / 2 : valueString.toDouble();
+    double oldValue;
+    bool parseSuccess = HTMLInputElement::formStringToDouble(element->value(), &oldValue);
+    if (!parseSuccess)
+        oldValue = (minimum + maximum) / 2;
     double newValue = clampValue(oldValue);
 
     if (wasClamped)
-        *wasClamped = valueString.isNull() || newValue != oldValue;
+        *wasClamped = !parseSuccess || newValue != oldValue;
 
     return newValue;
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
index 8478432..a49e092 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -45,7 +45,9 @@ RenderTextControlMultiLine::~RenderTextControlMultiLine()
 void RenderTextControlMultiLine::subtreeHasChanged()
 {
     RenderTextControl::subtreeHasChanged();
-    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(false);
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    textArea->setFormControlValueMatchesRenderer(false);
+    textArea->updateValidity();
 
     if (!node()->focused())
         return;
@@ -53,7 +55,7 @@ void RenderTextControlMultiLine::subtreeHasChanged()
     node()->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
 
     if (Frame* frame = document()->frame())
-        frame->textDidChangeInTextArea(static_cast<Element*>(node()));
+        frame->textDidChangeInTextArea(textArea);
 }
 
 bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
index 8d8ba97..be800a7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -808,12 +808,12 @@ void RenderTextControlSingleLine::setScrollTop(int newTop)
         innerTextElement()->setScrollTop(newTop);
 }
 
-bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node** stopNode)
 {
     RenderLayer* layer = innerTextElement()->renderBox()->layer();
     if (layer && layer->scroll(direction, granularity, multiplier))
         return true;
-    return RenderBlock::scroll(direction, granularity, multiplier);
+    return RenderBlock::scroll(direction, granularity, multiplier, stopNode);
 }
 
 PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
index 4a17918..e30ff0d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
@@ -72,7 +72,7 @@ private:
     virtual int scrollHeight() const;
     virtual void setScrollLeft(int);
     virtual void setScrollTop(int);
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     int textBlockWidth() const;
     virtual int preferredContentWidth(float charWidth) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index b5826cd..5ee01e4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -85,6 +85,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
     
 #if USE(NEW_THEME)
     switch (part) {
+        case ListButtonPart:
         case CheckboxPart:
         case RadioPart:
         case PushButtonPart:
@@ -171,6 +172,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustRadioStyle(selector, style, e);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return adjustButtonStyle(selector, style, e);
@@ -227,6 +229,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             m_theme->paint(part, controlStatesForRenderer(o), const_cast<GraphicsContext*>(paintInfo.context), r, o->style()->effectiveZoom(), o->view()->frameView());
@@ -245,6 +248,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintRadio(o, paintInfo, r);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return paintButton(o, paintInfo, r);
@@ -335,6 +339,7 @@ bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
@@ -369,6 +374,7 @@ bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
index 9f412a0..61b5e8f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -121,6 +121,7 @@ protected:
     virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
 #if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
index 695f9fa..bcfcd57 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -29,7 +29,6 @@
 #import "Document.h"
 #import "Element.h"
 #import "FrameView.h"
-#import "Gradient.h"
 #import "GraphicsContext.h"
 #import "HTMLInputElement.h"
 #import "HTMLMediaElement.h"
@@ -38,6 +37,7 @@
 #import "LocalCurrentGraphicsContext.h"
 #import "MediaControlElements.h"
 #import "RenderMedia.h"
+#import "RenderMediaControlsChromium.h"
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
@@ -1251,20 +1251,6 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     return false;
 }
 
-#if ENABLE(VIDEO)
-static Image* mediaSliderThumbImage()
-{
-    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
-    return mediaSliderThumb;
-}
-  
-static Image* mediaVolumeSliderThumbImage()
-{
-    static Image* mediaVolumeSliderThumb = Image::loadPlatformResource("mediaVolumeSliderThumb").releaseRef();
-    return mediaVolumeSliderThumb;
-}
-#endif
-
 void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
 {
     static const int sliderThumbWidth = 15;
@@ -1277,16 +1263,7 @@ void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
     }
 
 #if ENABLE(VIDEO)
-    Image* thumbImage = 0;
-    if (o->style()->appearance() == MediaSliderThumbPart)
-        thumbImage = mediaSliderThumbImage();
-    else if (o->style()->appearance() == MediaVolumeSliderThumbPart)
-        thumbImage = mediaVolumeSliderThumbImage();
-  
-    if (thumbImage) {
-        o->style()->setWidth(Length(thumbImage->width(), Fixed));
-        o->style()->setHeight(Length(thumbImage->height(), Fixed));
-    }
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
 #endif
 }
 
@@ -1537,173 +1514,44 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 }
 
 #if ENABLE(VIDEO)
-// Attempt to retrieve a HTMLMediaElement from a Node. Returns 0 if one cannot be found.
-static HTMLMediaElement* mediaElementParent(Node* node)
-{
-    if (!node)
-        return 0;
-    Node* mediaNode = node->shadowAncestorNode();
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
-bool RenderThemeChromiumMac::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
+bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
-    IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
-    return true;
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 
 bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
-    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-    static Image* mediaPlayDisabled = Image::loadPlatformResource("mediaPlayDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
-        return paintMediaButtonInternal(paintInfo.context, rect, mediaPlayDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
-    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
-    static Image* soundDisabled = Image::loadPlatformResource("mediaSoundDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
-        return paintMediaButtonInternal(paintInfo.context, rect, soundDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone : soundFull);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    RenderStyle* style = object->style();    
-    GraphicsContext* context = paintInfo.context;
-    context->save();
-    
-    context->setShouldAntialias(true);
-
-    IntSize topLeftRadius = style->borderTopLeftRadius();
-    IntSize topRightRadius = style->borderTopRightRadius();
-    IntSize bottomLeftRadius = style->borderBottomLeftRadius();
-    IntSize bottomRightRadius = style->borderBottomRightRadius();
-    float borderWidth = style->borderLeftWidth();
-
-    // Draw the border of the time bar.
-    context->setStrokeColor(style->borderLeftColor());
-    context->setStrokeThickness(borderWidth);
-    context->setFillColor(style->backgroundColor());
-    context->addPath(Path::createRoundedRectangle(rect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius));
-    context->drawPath();
-    
-    // Draw the buffered ranges.
-    // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-    FloatRect bufferedRect = rect;
-    bufferedRect.inflate(-1.0 - borderWidth);
-    bufferedRect.setWidth(bufferedRect.width() * mediaElement->percentLoaded());
-    bufferedRect = context->roundToDevicePixels(bufferedRect);
-   
-    // Don't bother drawing an empty area.
-    if (bufferedRect.width() > 0 && bufferedRect.height() > 0) {
-        FloatPoint sliderTopLeft = bufferedRect.location();
-        FloatPoint sliderTopRight = sliderTopLeft;
-        sliderTopRight.move(0.0f, bufferedRect.height());
-        
-        RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderTopRight);
-        Color startColor = object->style()->color();
-        gradient->addColorStop(0.0, startColor);
-        gradient->addColorStop(1.0, Color(startColor.red() / 2, startColor.green() / 2, startColor.blue() / 2, startColor.alpha()));
- 
-        context->setFillGradient(gradient);
-        context->addPath(Path::createRoundedRectangle(bufferedRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius));
-        context->fillPath();
-    }
-    
-    context->restore();    
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    GraphicsContext* context = paintInfo.context;
-    Color originalColor = context->strokeColor();
-    if (originalColor != Color::white)
-        context->setStrokeColor(Color::white);
-
-    int x = rect.x() + rect.width() / 2;
-    context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
-    
-    if (originalColor != Color::white)
-        context->setStrokeColor(originalColor);
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaVolumeSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 }
 
 bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    if (!rect.isEmpty())
-    {
-        GraphicsContext* context = paintInfo.context;
-        Color originalColor = context->strokeColor();
- 
-        // Draws the left border, it is always 1px wide.
-        context->setStrokeColor(object->style()->borderLeftColor());
-        context->drawLine(IntPoint(rect.x() + 1, rect.y()),
-                          IntPoint(rect.x() + 1, rect.y() + rect.height()));
-                         
-
-        // Draws the right border, it is always 1px wide.
-        context->setStrokeColor(object->style()->borderRightColor());
-        context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
-                          IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
-        
-        context->setStrokeColor(originalColor);
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 }
     
 String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 4f486d5..fb42bb7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -33,6 +33,7 @@
 #include "MediaControlElements.h"
 #include "PlatformContextSkia.h"
 #include "RenderBox.h"
+#include "RenderMediaControlsChromium.h"
 #include "RenderObject.h"
 #include "RenderSlider.h"
 #include "ScrollbarTheme.h"
@@ -96,20 +97,6 @@ static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
     drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
 
-#if ENABLE(VIDEO)
-// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
-static HTMLMediaElement* mediaElementParent(Node* node)
-{
-    if (!node)
-        return 0;
-    Node* mediaNode = node->shadowAncestorNode();
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-#endif
-
 // We aim to match IE here.
 // -IE uses a font based on the encoding as the default font for form controls.
 // -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
@@ -486,42 +473,10 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
     return false;
 }
 
-bool RenderThemeChromiumSkia::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
-{
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
-    IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
-    return true;
-}
-
 bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    if (!rect.isEmpty())
-    {
-        SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-        SkPaint paint;
-
-        // Draws the left border, it is always 1px wide.
-        paint.setColor(object->style()->borderLeftColor().rgb());
-        canvas->drawLine(rect.x() + 1, rect.y(),
-                         rect.x() + 1, rect.y() + rect.height(),
-                         paint);
-
-        // Draws the right border, it is always 1px wide.
-        paint.setColor(object->style()->borderRightColor().rgb());
-        canvas->drawLine(rect.x() + rect.width() - 1, rect.y(),
-                         rect.x() + rect.width() - 1, rect.y() + rect.height(),
-                         paint);
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -533,62 +488,7 @@ bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object,
 bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-    SkRect backgroundRect;
-    backgroundRect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-
-    SkPaint paint;
-    paint.setAntiAlias(true);
-
-    // Draw the border of the time bar. The border only has one single color,
-    // width and radius. So use the property of the left border.
-    SkColor borderColor = object->style()->borderLeftColor().rgb();
-    int borderWidth = object->style()->borderLeftWidth();
-    IntSize borderRadius = object->style()->borderTopLeftRadius();
-    paint.setStyle(SkPaint::kStroke_Style);
-    paint.setStrokeWidth(borderWidth);
-    paint.setColor(borderColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    // Draw the background of the time bar.
-    SkColor backgroundColor = object->style()->backgroundColor().rgb();
-    paint.setStyle(SkPaint::kFill_Style);
-    paint.setColor(backgroundColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    if (backgroundRect.width() >= 3 && backgroundRect.height() >= 3)
-    {
-        // Draw the buffered ranges.
-        // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-        SkRect bufferedRect;
-        bufferedRect.set(backgroundRect.fLeft + 2, backgroundRect.fTop + 2,
-                         backgroundRect.fRight - 1, backgroundRect.fBottom - 1);
-        int width = static_cast<int>(bufferedRect.width() * mediaElement->percentLoaded());
-        bufferedRect.fRight = bufferedRect.fLeft + width;
-
-        SkPoint points[2] = { { 0, bufferedRect.fTop }, { 0, bufferedRect.fBottom } };
-        SkColor startColor = object->style()->color().rgb();
-        SkColor endColor = SkColorSetRGB(SkColorGetR(startColor) / 2,
-                                         SkColorGetG(startColor) / 2,
-                                         SkColorGetB(startColor) / 2);
-        SkColor colors[2] = { startColor, endColor };
-        SkShader* gradient = SkGradientShader::CreateLinear(points, colors, 0,
-                                                            sizeof(points) / sizeof(points[0]),
-                                                            SkShader::kMirror_TileMode, 0);
-
-        paint.reset();
-        paint.setShader(gradient);
-        paint.setAntiAlias(true);
-        // Check for round rect with zero width or height, otherwise Skia will assert
-        if (bufferedRect.width() > 0 && bufferedRect.height() > 0)
-            canvas->drawRoundRect(bufferedRect, borderRadius.width(), borderRadius.height(), paint);
-        gradient->unref();
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -600,17 +500,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const
 bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-    SkPaint paint;
-    paint.setColor(SK_ColorWHITE);
-
-    int x = rect.x() + rect.width() / 2;
-    canvas->drawLine(x, rect.y(), x, rect.y() + rect.height(), paint);
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -619,31 +509,10 @@ bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object,
 #endif
 }
 
-static Image* mediaSliderThumbImage()
-{
-    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
-    return mediaSliderThumb;
-}
-
-static Image* mediaVolumeSliderThumbImage()
-{
-    static Image* mediaVolumeSliderThumb = Image::loadPlatformResource("mediaVolumeSliderThumb").releaseRef();
-    return mediaVolumeSliderThumb;
-}
-
 void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 {
 #if ENABLE(VIDEO)
-    Image* thumbImage = 0;
-    if (object->style()->appearance() == MediaSliderThumbPart)
-        thumbImage = mediaSliderThumbImage();
-    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
-        thumbImage = mediaVolumeSliderThumbImage();
-
-    if (thumbImage) {
-        object->style()->setWidth(Length(thumbImage->width(), Fixed));
-        object->style()->setHeight(Length(thumbImage->height(), Fixed));
-    }
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(object);
 #else
     UNUSED_PARAM(object);
 #endif
@@ -652,10 +521,7 @@ void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -667,10 +533,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const
 bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    if (!object->parent()->isSlider())
-        return false;
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaVolumeSliderThumbImage());
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -682,18 +545,7 @@ bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object,
 bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
-    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-    static Image* mediaPlayDisabled = Image::loadPlatformResource("mediaPlayDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
-        return paintMediaButtonInternal(paintInfo.context, rect, mediaPlayDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -705,18 +557,7 @@ bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const R
 bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
-    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
-    static Image* soundDisabled = Image::loadPlatformResource("mediaSoundDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
-        return paintMediaButtonInternal(paintInfo.context, rect, soundDisabled);
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -744,8 +585,9 @@ bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject:
     paint.setAntiAlias(true);
     paint.setStyle(SkPaint::kFill_Style);
 
+    int arrowXPosition = (o->style()->direction() == RTL) ? rect.x() + 7 : right - 13;
     SkPath path;
-    path.moveTo(right - 13, middle - 3);
+    path.moveTo(arrowXPosition, middle - 3);
     path.rLineTo(6, 0);
     path.rLineTo(-3, 6);
     path.close();
@@ -871,13 +713,7 @@ int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
 #if ENABLE(VIDEO)
 bool RenderThemeChromiumSkia::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(e);
-    switch (part) {
-    case MediaMuteButtonPart:
-        return true;
-    default:
-        return RenderTheme::shouldRenderMediaControlPart(part, e);
-    }
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
index bbc54a7..3b86980 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
@@ -59,7 +59,7 @@ namespace WebCore {
 
         // System fonts.
         virtual void systemFont(int propId, FontDescription&) const;
-        virtual Color systemColor(int cssValueId) const;
+        virtual Color systemColor(int cssValueId) const;

 
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
index 85f141f..1d68c63 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
@@ -132,6 +132,8 @@ protected:
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
+
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
 #endif
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 8e53088..2ea3b8b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -86,7 +86,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
     return safariTheme; // keep the reference of one.
 }
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
index ef78b07..9af7137 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
@@ -175,6 +175,12 @@ void RenderWidget::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+void RenderWidget::showSubstituteImage(PassRefPtr<Image> prpImage)
+{
+    m_substituteImage = prpImage;
+    repaint();
+}
+
 void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (!shouldPaint(paintInfo, tx, ty))
@@ -222,7 +228,10 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
-        m_widget->paint(paintInfo.context, paintInfo.rect);
+        if (m_substituteImage)
+            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
+        else
+            m_widget->paint(paintInfo.context, paintInfo.rect);
 
         if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
index 098f69e..78537fd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
@@ -40,6 +40,8 @@ public:
 
     void updateWidgetPosition();
 
+    void showSubstituteImage(PassRefPtr<Image>);
+
 protected:
     RenderWidget(Node*);
 
@@ -66,6 +68,7 @@ private:
     void deref(RenderArena*);
 
     RefPtr<Widget> m_widget;
+    RefPtr<Image> m_substituteImage;
     FrameView* m_frameView;
     int m_refCount;
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
index fb6866f..0f295e4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
@@ -220,7 +220,7 @@ FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object
 #if ENABLE(FILTERS)
     SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter());
     if (filter)
-        return filter->filterBBoxForItemBBox(object->objectBoundingBox());
+        return filter->filterBoundingBox();
 #else
     UNUSED_PARAM(object);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
index be5d1cf..1e1688c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
@@ -462,7 +462,7 @@ public:
             return font().lineSpacing();
 
         if (lh.isPercent())
-            return lh.calcMinValue(fontSize());
+            return lh.calcMinValue(fontSize(), true);
 
         return lh.value();
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
index a47defb..3010947 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
@@ -72,6 +72,7 @@ enum PseudoId {
     MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
     MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
     MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    INPUT_LIST_BUTTON,
 
     FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
 };
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
index 0e9dae4..e50d349 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyle.h
@@ -65,7 +65,6 @@ namespace WebCore {
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineJoin, JoinStyle, joinStyle, MiterJoin)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EShapeRendering, ShapeRendering, shapeRendering, SR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextAnchor, TextAnchor, textAnchor, TA_START)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextRendering, TextRendering, textRendering, TR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EWritingMode, WritingMode, writingMode, WM_LRTB)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationHorizontal, glyphOrientationHorizontal, GO_0DEG)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationVertical, glyphOrientationVertical, GO_AUTO)
@@ -113,7 +112,6 @@ namespace WebCore {
                 return (_colorRendering == other._colorRendering) &&
                        (_imageRendering == other._imageRendering) &&
                        (_shapeRendering == other._shapeRendering) &&
-                       (_textRendering == other._textRendering) &&
                        (_clipRule == other._clipRule) &&
                        (_fillRule == other._fillRule) &&
                        (_capStyle == other._capStyle) &&
@@ -134,7 +132,6 @@ namespace WebCore {
             unsigned _colorRendering : 2; // EColorRendering
             unsigned _imageRendering : 2; // EImageRendering 
             unsigned _shapeRendering : 2; // EShapeRendering 
-            unsigned _textRendering : 2; // ETextRendering
             unsigned _clipRule : 1; // WindRule
             unsigned _fillRule : 1; // WindRule
             unsigned _capStyle : 2; // LineCap
@@ -190,7 +187,6 @@ namespace WebCore {
             svg_inherited_flags._fillRule = initialFillRule();
             svg_inherited_flags._imageRendering = initialImageRendering();
             svg_inherited_flags._shapeRendering = initialShapeRendering();
-            svg_inherited_flags._textRendering = initialTextRendering();
             svg_inherited_flags._textAnchor = initialTextAnchor();
             svg_inherited_flags._capStyle = initialCapStyle();
             svg_inherited_flags._joinStyle = initialJoinStyle();
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
index b7bf026..c0f5d4e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -95,10 +95,6 @@ namespace WebCore {
         SR_AUTO, SR_OPTIMIZESPEED, SR_CRISPEDGES, SR_GEOMETRICPRECISION
     };
 
-    enum ETextRendering {
-        TR_AUTO, TR_OPTIMIZESPEED, TR_OPTIMIZELEGIBILITY, TR_GEOMETRICPRECISION
-    };
-
     enum EWritingMode {
         WM_LRTB, WM_LR, WM_RLTB, WM_RL, WM_TBRL, WM_TB
     };
diff --git a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
index 33660e7..17a9407 100644
--- a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
@@ -34,8 +34,8 @@
 namespace WebCore {
 
 ChangeVersionWrapper::ChangeVersionWrapper(const String& oldVersion, const String& newVersion)
-    : m_oldVersion(oldVersion.copy())
-    , m_newVersion(newVersion.copy())
+    : m_oldVersion(oldVersion.crossThreadString())
+    , m_newVersion(newVersion.crossThreadString())
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.cpp b/src/3rdparty/webkit/WebCore/storage/Database.cpp
index be0c490..08ea289 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Database.cpp
@@ -89,6 +89,22 @@ static GuidVersionMap& guidToVersionMap()
     return map;
 }
 
+// NOTE: Caller must lock guidMutex().
+static inline void updateGuidVersionMap(int guid, String newVersion)
+{
+    // Ensure the the mutex is locked.
+    ASSERT(!guidMutex().tryLock());
+
+    // Note: It is not safe to put an empty string into the guidToVersionMap() map.
+    // That's because the map is cross-thread, but empty strings are per-thread.
+    // The copy() function makes a version of the string you can use on the current
+    // thread, but we need a string we can keep in a cross-thread data structure.
+    // FIXME: This is a quite-awkward restriction to have to program with.
+
+    // Map null string to empty string (see comment above).
+    guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.threadsafeCopy());
+}
+
 typedef HashMap<int, HashSet<Database*>*> GuidDatabaseMap;
 static GuidDatabaseMap& guidToDatabaseMap()
 {
@@ -134,7 +150,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
 Database::Database(Document* document, const String& name, const String& expectedVersion)
     : m_transactionInProgress(false)
     , m_document(document)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion)
     , m_deleted(false)
@@ -149,8 +165,6 @@ Database::Database(Document* document, const String& name, const String& expecte
 
 #if USE(JSC)
     JSC::initializeThreading();
-    // Database code violates the normal JSCore contract by calling jsUnprotect from a secondary thread, and thus needs additional locking.
-    JSDOMWindow::commonJSGlobalData()->heap.setGCProtectNeedsLocking();
 #endif
 
     m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
@@ -177,20 +191,6 @@ Database::Database(Document* document, const String& name, const String& expecte
 
 Database::~Database()
 {
-    {
-        MutexLocker locker(guidMutex());
-
-        HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
-        ASSERT(hashSet);
-        ASSERT(hashSet->contains(this));
-        hashSet->remove(this);
-        if (hashSet->isEmpty()) {
-            guidToDatabaseMap().remove(m_guid);
-            delete hashSet;
-            guidToVersionMap().remove(m_guid);
-        }
-    }
-
     if (m_document->databaseThread())
         m_document->databaseThread()->unscheduleDatabaseTasks(this);
 
@@ -245,7 +245,7 @@ bool Database::getVersionFromDatabase(String& version)
 
     m_databaseAuthorizer->disable();
 
-    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.copy(), version);
+    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to retrieve version from database %s", databaseDebugName().ascii().data());
 
@@ -277,11 +277,13 @@ static bool setTextValueInDatabase(SQLiteDatabase& db, const String& query, cons
 
 bool Database::setVersionInDatabase(const String& version)
 {
+    // The INSERT will replace an existing entry for the database with the new version number, due to the UNIQUE ON CONFLICT REPLACE
+    // clause in the CREATE statement (see Database::performOpenAndVerify()).
     DEFINE_STATIC_LOCAL(String, setVersionQuery, ("INSERT INTO " + databaseInfoTableName() + " (key, value) VALUES ('" + databaseVersionKey() + "', ?);"));
 
     m_databaseAuthorizer->disable();
 
-    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.copy(), version);
+    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to set version %s in database (%s)", version.ascii().data(), setVersionQuery.ascii().data());
 
@@ -330,6 +332,20 @@ void Database::close()
         m_sqliteDatabase.close();
         m_document->databaseThread()->recordDatabaseClosed(this);
         m_opened = false;
+
+        {
+            MutexLocker locker(guidMutex());
+
+            HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
+            ASSERT(hashSet);
+            ASSERT(hashSet->contains(this));
+            hashSet->remove(this);
+            if (hashSet->isEmpty()) {
+                guidToDatabaseMap().remove(m_guid);
+                delete hashSet;
+                guidToVersionMap().remove(m_guid);
+            }
+        }
     }
 }
 
@@ -449,15 +465,9 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     {
         MutexLocker locker(guidMutex());
 
-        // Note: It is not safe to put an empty string into the guidToVersionMap() map.
-        // That's because the map is cross-thread, but empty strings are per-thread.
-        // The copy() function makes a version of the string you can use on the current
-        // thread, but we need a string we can keep in a cross-thread data structure.
-        // FIXME: This is a quite-awkward restriction to have to program with.
-
         GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
         if (entry != guidToVersionMap().end()) {
-            // Map null string to empty string (see comment above).
+            // Map null string to empty string (see updateGuidVersionMap()).
             currentVersion = entry->second.isNull() ? String("") : entry->second;
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
         } else {
@@ -488,8 +498,7 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
                 currentVersion = m_expectedVersion;
             }
 
-            // Map empty string to null string (see comment above).
-            guidToVersionMap().set(m_guid, currentVersion.isEmpty() ? String() : currentVersion.copy());
+            updateGuidVersionMap(m_guid, currentVersion);
         }
     }
 
@@ -607,7 +616,7 @@ String Database::version() const
     if (m_deleted)
         return String();
     MutexLocker locker(guidMutex());
-    return guidToVersionMap().get(m_guid).copy();
+    return guidToVersionMap().get(m_guid).threadsafeCopy();
 }
 
 void Database::deliverPendingCallback(void* context)
@@ -632,18 +641,21 @@ Vector<String> Database::tableNames()
 
 void Database::setExpectedVersion(const String& version)
 {
-    m_expectedVersion = version.copy();
+    m_expectedVersion = version.threadsafeCopy();
+    // Update the in memory database version map.
+    MutexLocker locker(guidMutex());
+    updateGuidVersionMap(m_guid, version);
 }
 
 PassRefPtr<SecurityOrigin> Database::securityOriginCopy() const
 {
-    return m_securityOrigin->copy();
+    return m_securityOrigin->threadsafeCopy();
 }
 
 String Database::stringIdentifier() const
 {
     // Return a deep copy for ref counting thread safety
-    return m_name.copy();
+    return m_name.threadsafeCopy();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
index 491e6f1..265cd0d 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
@@ -762,7 +762,7 @@ void DatabaseTracker::scheduleNotifyDatabaseChanged(SecurityOrigin* origin, cons
 {
     MutexLocker locker(notificationMutex());
 
-    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.copy()));
+    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.crossThreadString()));
     scheduleForNotification();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
index 4cea845..12cc083 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
@@ -33,16 +33,18 @@
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<StorageAreaSync> area)
+LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
     : m_type(type)
     , m_area(area)
+    , m_thread(0)
 {
     ASSERT(m_area);
     ASSERT(m_type == AreaImport || m_type == AreaSync);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<LocalStorageThread> thread)
+LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     : m_type(type)
+    , m_area(0)
     , m_thread(thread)
 {
     ASSERT(m_thread);
@@ -57,11 +59,9 @@ void LocalStorageTask::performTask()
 {
     switch (m_type) {
         case AreaImport:
-            ASSERT(m_area);
             m_area->performImport();
             break;
         case AreaSync:
-            ASSERT(m_area);
             m_area->performSync();
             break;
         case TerminateThread:
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
index 726b41f..f03d851 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
@@ -44,19 +44,19 @@ namespace WebCore {
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(PassRefPtr<LocalStorageThread> thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
+        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
+        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
 
     private:
-        LocalStorageTask(Type, PassRefPtr<StorageAreaSync>);
-        LocalStorageTask(Type, PassRefPtr<LocalStorageThread>);
+        LocalStorageTask(Type, StorageAreaSync*);
+        LocalStorageTask(Type, LocalStorageThread*);
 
         Type m_type;
-        RefPtr<StorageAreaSync> m_area;
-        RefPtr<LocalStorageThread> m_thread;
+        StorageAreaSync* m_area;
+        LocalStorageThread* m_thread;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index c85d5e6..78640a9 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -86,13 +86,13 @@ void* LocalStorageThread::localStorageThread()
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleImport(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createImport(area));
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleSync(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createSync(area));
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
index b903fb9..e9e2b58 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
@@ -45,8 +45,8 @@ namespace WebCore {
 
         bool start();
 
-        void scheduleImport(PassRefPtr<StorageAreaSync>);
-        void scheduleSync(PassRefPtr<StorageAreaSync>);
+        void scheduleImport(StorageAreaSync*);
+        void scheduleSync(StorageAreaSync*);
 
         // Called from the main thread to synchronously shut down this thread
         void terminate();
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
index b757f70..20bb34d 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
@@ -79,7 +79,7 @@ void OriginQuotaManager::addDatabase(SecurityOrigin* origin, const String& datab
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
 
-    usageRecord->addDatabase(databaseIdentifier.copy(), fullPath.copy());
+    usageRecord->addDatabase(databaseIdentifier.threadsafeCopy(), fullPath.threadsafeCopy());
 }
 
 void OriginQuotaManager::removeDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLError.h b/src/3rdparty/webkit/WebCore/storage/SQLError.h
index a17efa9..4414e6b 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLError.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLError.h
@@ -41,10 +41,10 @@ public:
     static PassRefPtr<SQLError> create(unsigned code, const String& message) { return adoptRef(new SQLError(code, message)); }
 
     unsigned code() const { return m_code; }
-    String message() const { return m_message.copy(); }
+    String message() const { return m_message.threadsafeCopy(); }
 
 private:
-    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.copy()) { }
+    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.threadsafeCopy()) { }
     unsigned m_code;
     String m_message;
 };
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
index 970f757..b4eb9ef 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
@@ -50,7 +50,7 @@ PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vec
 }
 
 SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
-    : m_statement(statement.copy())
+    : m_statement(statement.crossThreadString())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
index dabbac2..149b384 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
@@ -232,8 +232,9 @@ void SQLTransaction::openTransactionAndPreflight()
         return;
     }
 
-    // Set the maximum usage for this transaction
-    m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
+    // Set the maximum usage for this transaction if this transactions is not read-only
+    if (!m_readOnly)
+        m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
 
     ASSERT(!m_sqliteTransaction);
     m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase, m_readOnly));
@@ -307,7 +308,10 @@ void SQLTransaction::runStatements()
             // FIXME - Another place that needs fixing up after <rdar://problem/5628468> is addressed.
             // See ::openTransactionAndPreflight() for discussion
 
-            // Reset the maximum size here, as it was increased to allow us to retry this statement
+            // Reset the maximum size here, as it was increased to allow us to retry this statement.
+            // m_shouldRetryCurrentStatement is set to true only when a statement exceeds
+            // the quota, which can happen only in a read-write transaction. Therefore, there
+            // is no need to check here if the transaction is read-write.
             m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
         } else {
             // If the current statement has already been run, failed due to quota constraints, and we're not retrying it,
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index e0f7f06..a64d44a 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -42,7 +42,7 @@ namespace WebCore {
     enum StorageType { LocalStorage, SessionStorage };
 
     // This interface is required for Chromium since these actions need to be proxied between processes.
-    class StorageArea : public ThreadSafeShared<StorageArea> {
+    class StorageArea : public RefCounted<StorageArea> {
     public:
         virtual ~StorageArea() { }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
index 66447d3..612cb5f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
@@ -28,16 +28,11 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "StorageEvent.h"
 #include "StorageAreaSync.h"
+#include "StorageEventDispatcher.h"
 #include "StorageMap.h"
 #include "StorageSyncManager.h"
 
@@ -45,22 +40,24 @@ namespace WebCore {
 
 StorageAreaImpl::~StorageAreaImpl()
 {
+    ASSERT(isMainThread());
 }
 
-PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
 {
-    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager));
+    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager, quota));
 }
 
-StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
     : m_storageType(storageType)
     , m_securityOrigin(origin)
-    , m_storageMap(StorageMap::create())
+    , m_storageMap(StorageMap::create(quota))
     , m_storageSyncManager(syncManager)
 #ifndef NDEBUG
     , m_isShutdown(false)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
 
@@ -87,6 +84,7 @@ StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
     , m_isShutdown(area->m_isShutdown)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
     ASSERT(!m_isShutdown);
@@ -137,15 +135,14 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
         return;
     }
 
-    // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
-    //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
-    // if (<over quota>) {
-    //     ec = QUOTA_EXCEEDED_ERR;
-    //     return;
-    // }
-
     String oldValue;
-    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue);
+    bool quotaException;
+    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+
+    if (quotaException) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
 
     if (newMap)
         m_storageMap = newMap.release();
@@ -154,7 +151,7 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     if (oldValue != value) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, value);
-        dispatchStorageEvent(key, oldValue, value, frame);
+        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -175,7 +172,7 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
     if (!oldValue.isNull()) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, String());
-        dispatchStorageEvent(key, oldValue, String(), frame);
+        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -187,11 +184,12 @@ void StorageAreaImpl::clear(Frame* frame)
     if (privateBrowsingEnabled(frame))
         return;
 
-    m_storageMap = StorageMap::create();
+    unsigned quota = m_storageMap->quota();
+    m_storageMap = StorageMap::create(quota);
 
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
-    dispatchStorageEvent(String(), String(), String(), frame);
+    StorageEventDispatcher::dispatch(String(), String(), String(), m_storageType, m_securityOrigin.get(), frame);
 }
 
 bool StorageAreaImpl::contains(const String& key) const
@@ -229,45 +227,6 @@ void StorageAreaImpl::blockUntilImportComplete() const
         m_storageAreaSync->blockUntilImportComplete();
 }
 
-void StorageAreaImpl::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-#if PLATFORM(CHROMIUM)
-    // FIXME: Events are currently broken in Chromium.
-    return;
-#endif
-
-    Page* page = sourceFrame->page();
-    if (!page)
-        return;
-
-    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
-    // of any given page in the group or mutate the page group itself.
-    Vector<RefPtr<Frame> > frames;
-    if (m_storageType == SessionStorage) {
-        // Send events only to our page.
-        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
-    } else {
-        // Send events to every page.
-        const HashSet<Page*>& pages = page->group().pages();
-        HashSet<Page*>::const_iterator end = pages.end();
-        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                    frames.append(frame);
-            }
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-    }
-}
-
 }
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
index a7cc9f6..fe21a45 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
     class StorageAreaImpl : public StorageArea {
     public:
-        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         virtual ~StorageAreaImpl();
 
         // The HTML5 DOM Storage API (and contains)
@@ -61,13 +61,11 @@ namespace WebCore {
         SecurityOrigin* securityOrigin();
 
     private:
-        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
 
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-
         StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index 2a642b4..ad41e28 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -57,6 +57,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
     , m_syncScheduled(false)
     , m_importComplete(false)
 {
+    ASSERT(isMainThread());
     ASSERT(m_storageArea);
     ASSERT(m_syncManager);
 
@@ -68,6 +69,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
 
 StorageAreaSync::~StorageAreaSync()
 {
+    ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
 }
 
@@ -138,7 +140,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
         }
 
         for (; it != end; ++it)
-            m_itemsPendingSync.set(it->first.copy(), it->second.copy());
+            m_itemsPendingSync.set(it->first.crossThreadString(), it->second.crossThreadString());
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
index f3b3b70..13ccfe9 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
 #include "Storage.h"
 
 namespace WebCore {
@@ -42,23 +41,22 @@ StorageEvent::StorageEvent()
 {
 }
 
-PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
 {
-    return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source, storageArea));
+    return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, storageArea));
 }
 
-StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
     : Event(type, false, true)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
     , m_uri(uri)
-    , m_source(source)
     , m_storageArea(storageArea)
 {
 }
 
-void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
 {
     if (dispatched())
         return;
@@ -69,7 +67,6 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
     m_oldValue = oldValue;
     m_newValue = newValue;
     m_uri = uri;
-    m_source = source;
     m_storageArea = storageArea;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
index 7e2bcff..fa7535b 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
@@ -33,37 +33,34 @@
 
 namespace WebCore {
 
-    class DOMWindow;
     class Storage;
 
     class StorageEvent : public Event {
     public:
         static PassRefPtr<StorageEvent> create();
-        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         const String& key() const { return m_key; }
         const String& oldValue() const { return m_oldValue; }
         const String& newValue() const { return m_newValue; }
         const String& uri() const { return m_uri; }
-        DOMWindow* source() const { return m_source.get(); }
         Storage* storageArea() const { return m_storageArea.get(); }
 
-        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg,  Storage storageAreaArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, Storage storageAreaArg);
 
         virtual bool isStorageEvent() const { return true; }
 
     private:
         StorageEvent();
-        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
-        RefPtr<DOMWindow> m_source;
         RefPtr<Storage> m_storageArea;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
index 5a3f993..7c87561 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.idl
@@ -33,12 +33,11 @@ module storage {
         readonly attribute [ConvertNullStringTo=Null] DOMString oldValue;
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
-        readonly attribute DOMWindow source;
         readonly attribute Storage storageArea;
-        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
+        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Storage storageAreaArg);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
new file mode 100644
index 0000000..d2eab66
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEventDispatcher.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageEventDispatcher.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DOMWindow.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "SecurityOrigin.h"
+#include "StorageEvent.h"
+
+namespace WebCore {
+
+void StorageEventDispatcher::dispatch(const String& key, const String& oldValue, const String& newValue, StorageType storageType, SecurityOrigin* securityOrigin, Frame* sourceFrame)
+{
+    Page* page = sourceFrame->page();
+    if (!page)
+        return;
+
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+    if (storageType == SessionStorage) {
+        // Send events only to our page.
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin))
+                frames.append(frame);
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), frames[i]->domWindow()->sessionStorage()));
+    } else {
+        // Send events to every page.
+        const HashSet<Page*>& pages = page->group().pages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                if (frame->document()->securityOrigin()->equal(securityOrigin))
+                    frames.append(frame);
+            }
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), frames[i]->domWindow()->localStorage()));
+    }
+}
+
+}
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
index 6ddf323..5498d9e 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
@@ -30,20 +30,22 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageMap> StorageMap::create()
+PassRefPtr<StorageMap> StorageMap::create(unsigned quota)
 {
-    return adoptRef(new StorageMap);
+    return adoptRef(new StorageMap(quota));
 }
 
-StorageMap::StorageMap()
+StorageMap::StorageMap(unsigned quota)
     : m_iterator(m_map.end())
     , m_iteratorIndex(UINT_MAX)
+    , m_quotaSize(quota)  // quota measured in bytes
+    , m_currentLength(0)
 {
 }
 
 PassRefPtr<StorageMap> StorageMap::copy()
 {
-    RefPtr<StorageMap> newMap = create();
+    RefPtr<StorageMap> newMap = create(m_quotaSize);
     newMap->m_map = m_map;
     return newMap.release();
 }
@@ -54,7 +56,7 @@ void StorageMap::invalidateIterator()
     m_iteratorIndex = UINT_MAX;
 }
 
-void StorageMap::setIteratorToIndex(unsigned index) const
+void StorageMap::setIteratorToIndex(unsigned index)
 {
     // FIXME: Once we have bidirectional iterators for HashMap we can be more intelligent about this.
     // The requested index will be closest to begin(), our current iterator, or end(), and we
@@ -82,7 +84,7 @@ unsigned StorageMap::length() const
     return m_map.size();
 }
 
-String StorageMap::key(unsigned index) const
+String StorageMap::key(unsigned index)
 {
     if (index >= length())
         return String();
@@ -96,27 +98,34 @@ String StorageMap::getItem(const String& key) const
     return m_map.get(key);
 }
 
-PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue)
+PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue, bool& quotaException)
 {
     ASSERT(!value.isNull());
+    quotaException = false;
 
     // Implement copy-on-write semantics here.  We're guaranteed that the only refs of StorageMaps belong to Storage objects
     // so if more than one Storage object refs this map, copy it before mutating it.
     if (refCount() > 1) {
         RefPtr<StorageMap> newStorageMap = copy();
-        newStorageMap->setItem(key, value, oldValue);
+        newStorageMap->setItem(key, value, oldValue, quotaException);
         return newStorageMap.release();
     }
 
-    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    oldValue = m_map.get(key);
+    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    bool overQuota = newLength > m_quotaSize / sizeof(UChar);
+    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
+    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
+    if (m_quotaSize != noQuota && (overflow || overQuota)) {
+        quotaException = true;
+        return 0;
+    }
+    m_currentLength = newLength;
 
-    if (addResult.second) {
-        // There was no "oldValue" so null it out.
-        oldValue = String();
-    } else {
-        oldValue = addResult.first->second;
+    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    if (!addResult.second)
         addResult.first->second = value;
-    }
 
     invalidateIterator();
 
@@ -137,6 +146,10 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     if (!oldValue.isNull())
         invalidateIterator();
 
+    // Update quota.
+    ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
+    m_currentLength -= oldValue.length();
+
     return 0;
 }
 
@@ -145,14 +158,18 @@ bool StorageMap::contains(const String& key) const
     return m_map.contains(key);
 }
 
-void StorageMap::importItem(const String& key, const String& value) const
+void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.copy(), String());
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
 
     if (result.second)
-        result.first->second = value.copy();
+        result.first->second = value.threadsafeCopy();
+
+    // Update quota.
+    ASSERT(m_currentLength + value.length() >= m_currentLength);
+    m_currentLength += value.length();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.h b/src/3rdparty/webkit/WebCore/storage/StorageMap.h
index afb90bb..fa5f46c 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.h
@@ -39,27 +39,35 @@ namespace WebCore {
 
     class StorageMap : public RefCounted<StorageMap> {
     public:
-        static PassRefPtr<StorageMap> create();
+        // Quota size mesured in bytes.
+        static PassRefPtr<StorageMap> create(unsigned quotaSize);
 
         unsigned length() const;
-        String key(unsigned index) const;
+        String key(unsigned index);
         String getItem(const String&) const;
-        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue);
+        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue, bool& quota_exception);
         PassRefPtr<StorageMap> removeItem(const String&, String& oldValue);
 
         bool contains(const String& key) const;
 
-        void importItem(const String& key, const String& value) const;
+        void importItem(const String& key, const String& value);
+
+        unsigned quota() const { return m_quotaSize; }
+
+        static const unsigned noQuota = UINT_MAX;
 
     private:
-        StorageMap();
+        StorageMap(unsigned quota);
         PassRefPtr<StorageMap> copy();
         void invalidateIterator();
-        void setIteratorToIndex(unsigned) const;
+        void setIteratorToIndex(unsigned);
+
+        HashMap<String, String> m_map;
+        HashMap<String, String>::iterator m_iterator;
+        unsigned m_iteratorIndex;
 
-        mutable HashMap<String, String> m_map;
-        mutable HashMap<String, String>::iterator m_iterator;
-        mutable unsigned m_iteratorIndex;
+        unsigned m_quotaSize;  // Measured in bytes.
+        unsigned m_currentLength;  // Measured in UChars.
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
index 6fcae63..6b8caeb 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
@@ -36,9 +36,9 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path, unsigned quota)
 {
-    return StorageNamespaceImpl::localStorageNamespace(path);
+    return StorageNamespaceImpl::localStorageNamespace(path, quota);
 }
 
 PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
index 6866746..0ac5f86 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -41,7 +41,7 @@ namespace WebCore {
     // This interface is required for Chromium since these actions need to be proxied between processes.
     class StorageNamespace : public RefCounted<StorageNamespace> {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespace() { }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
index d5af31f..19ff6b4 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
@@ -31,6 +31,7 @@
 #include "SecurityOriginHash.h"
 #include "StringHash.h"
 #include "StorageAreaImpl.h"
+#include "StorageMap.h"
 #include "StorageSyncManager.h"
 #include <wtf/StdLibExtras.h>
 
@@ -44,12 +45,12 @@ static LocalStorageNamespaceMap& localStorageNamespaceMap()
     return localStorageNamespaceMap;
 }
 
-PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path, unsigned quota)
 {
     const String lookupPath = path.isNull() ? String("") : path;
     LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
     if (it == localStorageNamespaceMap().end()) {
-        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath));
+        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath, quota));
         localStorageNamespaceMap().set(lookupPath, storageNamespace.get());
         return storageNamespace.release();
     }
@@ -59,13 +60,14 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const S
 
 PassRefPtr<StorageNamespace> StorageNamespaceImpl::sessionStorageNamespace()
 {
-    return adoptRef(new StorageNamespaceImpl(SessionStorage, String()));
+    return adoptRef(new StorageNamespaceImpl(SessionStorage, String(), StorageMap::noQuota));
 }
 
-StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path)
+StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path, unsigned quota)
     : m_storageType(storageType)
-    , m_path(path.copy())  // Copy makes it safe for our other thread to access the path.
+    , m_path(path.crossThreadString())
     , m_syncManager(0)
+    , m_quota(quota)
     , m_isShutdown(false)
 {
     if (m_storageType == LocalStorage && !m_path.isEmpty())
@@ -91,7 +93,7 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     ASSERT(!m_isShutdown);
     ASSERT(m_storageType == SessionStorage);
 
-    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path);
+    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path, m_quota);
 
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i)
@@ -109,7 +111,7 @@ PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(PassRefPtr<SecurityOri
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager);
+    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager, m_quota);
     m_storageAreaMap.set(origin.release(), storageArea);
     return storageArea.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
index 05a12ad..b81b55a 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
     class StorageNamespaceImpl : public StorageNamespace {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespaceImpl();
@@ -52,7 +52,7 @@ namespace WebCore {
         virtual void unlock();
 
     private:
-        StorageNamespaceImpl(StorageType, const String& path);
+        StorageNamespaceImpl(StorageType, const String& path, unsigned quota);
 
         typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageAreaImpl>, SecurityOriginHash> StorageAreaMap;
         StorageAreaMap m_storageAreaMap;
@@ -63,6 +63,7 @@ namespace WebCore {
         String m_path;
         RefPtr<StorageSyncManager> m_syncManager;
 
+        unsigned m_quota;  // The default quota for each new storage area.
         bool m_isShutdown;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
index 961b9b2..f9276dd 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
@@ -48,8 +48,9 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.copy())
+    : m_path(path.crossThreadString())
 {
+    ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
     m_thread = LocalStorageThread::create();
     m_thread->start();
@@ -57,6 +58,7 @@ StorageSyncManager::StorageSyncManager(const String& path)
 
 StorageSyncManager::~StorageSyncManager()
 {
+    ASSERT(isMainThread());
 }
 
 String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
@@ -85,7 +87,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleImport(area);
+        m_thread->scheduleImport(area.get());
 
     return m_thread;
 }
@@ -95,7 +97,7 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleSync(area);
+        m_thread->scheduleSync(area.get());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
index b8c817f..fe35e3d 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
@@ -31,8 +31,8 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -40,7 +40,7 @@ namespace WebCore {
     class SecurityOrigin;
     class StorageAreaSync;
 
-    class StorageSyncManager : public ThreadSafeShared<StorageSyncManager> {
+    class StorageSyncManager : public RefCounted<StorageSyncManager> {
     public:
         static PassRefPtr<StorageSyncManager> create(const String& path);
         ~StorageSyncManager();
diff --git a/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
index fc59465..0aefbac 100644
--- a/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/LinearGradientAttributes.h
@@ -29,10 +29,10 @@
 namespace WebCore {
     struct LinearGradientAttributes : GradientAttributes {
         LinearGradientAttributes()
-            : m_x1(0.0)
-            , m_y1(0.0)
-            , m_x2(1.0)
-            , m_y2(0.0)
+            : m_x1()
+            , m_y1()
+            , m_x2(LengthModeWidth, "100%")
+            , m_y2()
             , m_x1Set(false)
             , m_y1Set(false)
             , m_x2Set(false)
@@ -40,15 +40,15 @@ namespace WebCore {
         {
         }
 
-        double x1() const { return m_x1; }
-        double y1() const { return m_y1; }
-        double x2() const { return m_x2; }
-        double y2() const { return m_y2; }
+        SVGLength x1() const { return m_x1; }
+        SVGLength y1() const { return m_y1; }
+        SVGLength x2() const { return m_x2; }
+        SVGLength y2() const { return m_y2; }
 
-        void setX1(double value) { m_x1 = value; m_x1Set = true; }
-        void setY1(double value) { m_y1 = value; m_y1Set = true; }
-        void setX2(double value) { m_x2 = value; m_x2Set = true; }
-        void setY2(double value) { m_y2 = value; m_y2Set = true; }
+        void setX1(const SVGLength& value) { m_x1 = value; m_x1Set = true; }
+        void setY1(const SVGLength& value) { m_y1 = value; m_y1Set = true; }
+        void setX2(const SVGLength& value) { m_x2 = value; m_x2Set = true; }
+        void setY2(const SVGLength& value) { m_y2 = value; m_y2Set = true; }
 
         bool hasX1() const { return m_x1Set; }
         bool hasY1() const { return m_y1Set; }
@@ -57,10 +57,10 @@ namespace WebCore {
 
     private:
         // Properties
-        double m_x1;
-        double m_y1;
-        double m_x2;
-        double m_y2;
+        SVGLength m_x1;
+        SVGLength m_y1;
+        SVGLength m_x2;
+        SVGLength m_y2;
 
         // Property states
         bool m_x1Set : 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h b/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
index 273cd29..7645721 100644
--- a/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/RadialGradientAttributes.h
@@ -29,11 +29,11 @@
 namespace WebCore {
     struct RadialGradientAttributes : GradientAttributes {
         RadialGradientAttributes()
-            : m_cx(0.5)
-            , m_cy(0.5)
-            , m_r(0.5)
-            , m_fx(0.0)
-            , m_fy(0.0)
+            : m_cx(LengthModeWidth, "50%")
+            , m_cy(LengthModeWidth, "50%")
+            , m_r(LengthModeWidth, "50%")
+            , m_fx()
+            , m_fy()
             , m_cxSet(false)
             , m_cySet(false)
             , m_rSet(false)
@@ -42,17 +42,17 @@ namespace WebCore {
         {
         }
 
-        double cx() const { return m_cx; }
-        double cy() const { return m_cy; }
-        double r() const { return m_r; }
-        double fx() const { return m_fx; }
-        double fy() const { return m_fy; }
+        SVGLength cx() const { return m_cx; }
+        SVGLength cy() const { return m_cy; }
+        SVGLength r() const { return m_r; }
+        SVGLength fx() const { return m_fx; }
+        SVGLength fy() const { return m_fy; }
 
-        void setCx(double value) { m_cx = value; m_cxSet = true; }
-        void setCy(double value) { m_cy = value; m_cySet = true; }
-        void setR(double value) { m_r = value; m_rSet = true; }
-        void setFx(double value) { m_fx = value; m_fxSet = true; }
-        void setFy(double value) { m_fy = value; m_fySet = true; }
+        void setCx(const SVGLength& value) { m_cx = value; m_cxSet = true; }
+        void setCy(const SVGLength& value) { m_cy = value; m_cySet = true; }
+        void setR(const SVGLength& value) { m_r = value; m_rSet = true; }
+        void setFx(const SVGLength& value) { m_fx = value; m_fxSet = true; }
+        void setFy(const SVGLength& value) { m_fy = value; m_fySet = true; }
 
         bool hasCx() const { return m_cxSet; }
         bool hasCy() const { return m_cySet; }
@@ -62,11 +62,11 @@ namespace WebCore {
 
     private:
         // Properties
-        double m_cx;
-        double m_cy;
-        double m_r;
-        double m_fx;
-        double m_fy;
+        SVGLength m_cx;
+        SVGLength m_cy;
+        SVGLength m_r;
+        SVGLength m_fx;
+        SVGLength m_fy;
 
         // Property states
         bool m_cxSet : 1;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
index 6bf7f91..7cb7b3e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderTypes.h"
 #include "KeyboardEvent.h"
 #include "MappedAttribute.h"
 #include "MouseEvent.h"
@@ -53,6 +54,8 @@ SVGAElement::SVGAElement(const QualifiedName& tagName, Document *doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_target(this, SVGNames::targetAttr)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -152,7 +155,7 @@ void SVGAElement::defaultEventHandler(Event* evt)
             }
 #endif
             if (document()->frame())
-                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true);
+                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true, SendReferrer);
         }
 
         evt->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
index 8890ca4..a3e59c5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,11 +58,16 @@ namespace WebCore {
 
         virtual bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGNames::aTagString, SVGNames::targetAttrString, String, Target, target)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
index 6ca4539..6606243 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
@@ -67,6 +67,7 @@
 #include "SVGFELightElement.cpp"
 #include "SVGFEMergeElement.cpp"
 #include "SVGFEMergeNodeElement.cpp"
+#include "SVGFEMorphologyElement.cpp"
 #include "SVGFEOffsetElement.cpp"
 #include "SVGFEPointLightElement.cpp"
 #include "SVGFESpecularLightingElement.cpp"
@@ -149,3 +150,4 @@
 #include "SVGViewSpec.cpp"
 #include "SVGZoomAndPan.cpp"
 #include "SVGZoomEvent.cpp"
+#include "SynchronizablePropertyController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
index d9da3f6..f13edf5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 SVGAltGlyphElement::SVGAltGlyphElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
index 91c99e3..b571880 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAltGlyphElement.h
@@ -47,8 +47,9 @@ namespace WebCore {
     
         SVGGlyphElement* glyphElement() const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAltGlyphElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
index 6803055..984046f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -62,14 +63,16 @@ namespace WebCore {
     struct IsDerivedFromSVGElement;
 
     // Helper template used for synchronizing SVG <-> XML properties
-    template<typename OwnerElement, typename DecoratedType>
-    void synchronizeProperty(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue);
+    template<typename OwnerType, typename DecoratedType, bool isDerivedFromSVGElement>
+    struct PropertySynchronizer;
 
     // Abstract base class
     class SVGAnimatedPropertyBase : public Noncopyable {
     public:
         virtual ~SVGAnimatedPropertyBase() { }
         virtual void synchronize() const = 0;
+        virtual void startAnimation() const = 0;
+        virtual void stopAnimation() = 0;
     };
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -124,6 +127,7 @@ namespace WebCore {
         // Tear offs only used by bindings, never in internal code
         PassRefPtr<TearOff> animatedTearOff() const;
 
+        void registerProperty();
         virtual void synchronize() const;
 
         void startAnimation() const;
@@ -140,6 +144,10 @@ namespace WebCore {
         const AtomicString& m_attributeIdentifier;
 
         mutable SynchronizableTypeWrapper<StorableType> m_value;
+
+#ifndef NDEBUG
+        bool m_registered;
+#endif
     };
 
     // SVGAnimatedPropertyTearOff implementation
@@ -186,8 +194,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value()
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -198,8 +210,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value()
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -211,8 +227,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -225,8 +245,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -239,8 +263,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1, arg2)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -254,8 +282,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1, arg2)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -269,8 +301,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1, arg2, arg3)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -285,20 +321,26 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1, arg2, arg3)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::value() const
     {
+        ASSERT(m_registered);
         return m_value;
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setValue(typename SVGAnimatedProperty::DecoratedType newValue)
     {
+        ASSERT(m_registered);
         m_value = newValue;
         ownerElement()->setSynchronizedSVGAttributes(false);
     }
@@ -307,6 +349,7 @@ namespace WebCore {
     typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::baseValue() const
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
         SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
         if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier))
@@ -318,6 +361,7 @@ namespace WebCore {
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setBaseValue(typename SVGAnimatedProperty::DecoratedType newValue)
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
         SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
         if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier)) {
@@ -334,25 +378,38 @@ namespace WebCore {
     PassRefPtr<typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::TearOff>
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::animatedTearOff() const
     {
+        ASSERT(m_registered);
         return lookupOrCreateWrapper<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName, TearOff, OwnerElement>(*this, ownerElement(), m_attributeName, m_attributeIdentifier);
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
+    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::registerProperty()
+    {
+        ASSERT(!m_registered);
+        ownerElement()->propertyController().registerProperty(m_attributeName, this);
+
+#ifndef NDEBUG
+        m_registered = true;
+#endif
+    }
+
+    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::synchronize() const
     {
+        ASSERT(m_registered);
         if (!m_value.needsSynchronization()) 
             return; 
 
-        synchronizeProperty<OwnerElement, DecoratedType>(ownerElement(), m_attributeName, baseValue());
+        PropertySynchronizer<OwnerElement, DecoratedType, IsDerivedFromSVGElement<OwnerType>::value>::synchronize(ownerElement(), m_attributeName, baseValue());
         m_value.setSynchronized(); 
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::startAnimation() const
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions) {
+        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
             ASSERT(!extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
             extensions->setBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier, m_value);
         }
@@ -361,12 +418,12 @@ namespace WebCore {
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::stopAnimation()
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions) {
+        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
             ASSERT(extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
             setValue(extensions->baseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
-            extensions->removeBaseValue<AnimatedType>(ownerElement, m_attributeIdentifier);
+            extensions->removeBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier);
         }
     }
 
@@ -406,39 +463,37 @@ namespace WebCore {
         static const bool value = true;
     };
 
-    class SVGExternalResourcesRequired;
-    template<>
-    struct IsDerivedFromSVGElement<SVGExternalResourcesRequired> : Noncopyable {
-        static const bool value = false;
-    };
-
-    class SVGFitToViewBox;
+    class SVGViewSpec;
     template<>
-    struct IsDerivedFromSVGElement<SVGFitToViewBox> : Noncopyable {
+    struct IsDerivedFromSVGElement<SVGViewSpec> : Noncopyable {
         static const bool value = false;
     };
 
-    class SVGURIReference;
-    template<>
-    struct IsDerivedFromSVGElement<SVGURIReference> : Noncopyable {
-        static const bool value = false;
+    // PropertySynchronizer implementation
+    template<typename OwnerElement, typename DecoratedType>
+    struct PropertySynchronizer<OwnerElement, DecoratedType, true> : Noncopyable {
+        static void synchronize(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
+        {
+            AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
+
+            NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
+            Attribute* old = namedAttrMap->getAttributeItem(attributeName);
+            if (old && value.isNull()) 
+                namedAttrMap->removeAttribute(old->name()); 
+            else if (!old && !value.isNull()) 
+                namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
+            else if (old && !value.isNull()) 
+                old->setValue(value); 
+        }
     };
 
-    // Central function handling the main SVG<->XML synchronization part.
     template<typename OwnerElement, typename DecoratedType>
-    void synchronizeProperty(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
-    {
-        AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
-
-        NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
-        Attribute* old = namedAttrMap->getAttributeItem(attributeName);
-        if (old && value.isNull()) 
-            namedAttrMap->removeAttribute(old->name()); 
-        else if (!old && !value.isNull()) 
-            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
-        else if (old && !value.isNull()) 
-            old->setValue(value); 
-    }
+    struct PropertySynchronizer<OwnerElement, DecoratedType, false> : Noncopyable {
+        static void synchronize(const OwnerElement*, const QualifiedName&, DecoratedType)
+        {
+            // no-op, for types not inheriting from Element, thus nothing to synchronize
+        }
+    };
 
     // Helper macro used to register animated properties within SVG* classes
     #define ANIMATED_PROPERTY_DECLARATIONS(OwnerType, ElementTag, AttributeTag, AnimatedType, UpperProperty, LowerProperty) \
@@ -451,8 +506,7 @@ namespace WebCore {
         void set##UpperProperty(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setValue(type); } \
         DecoratedTypeFor##UpperProperty LowerProperty##BaseValue() const { return m_##LowerProperty.baseValue(); } \
         void set##UpperProperty##BaseValue(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setBaseValue(type); } \
-        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); } \
-        void synchronize##UpperProperty() const { m_##LowerProperty.synchronize(); }
+        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); }
 
 };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
index 3f04c5b..e7c49c1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedTemplate.h
@@ -158,7 +158,7 @@ namespace WebCore {
 
         if (!wrapper) {
             wrapper = Type::create(creator, element, attrName);
-            element->addSVGPropertySynchronizer(attrName, creator);
+            element->propertyController().setPropertyNeedsSynchronization(attrName);
             Type::wrapperCache()->set(key, wrapper.get());
         }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
index cf945f8..67e32e0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
@@ -52,7 +52,8 @@ namespace WebCore {
 SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document* doc)
     : SVGSMILElement(tagName, doc)
     , SVGTests()
-    , SVGExternalResourcesRequired()
+    , SVGExternalResourcesRequired() 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_animationValid(false)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
index 1835a8d..b0b091b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
@@ -1,12 +1,10 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -66,8 +64,6 @@ namespace WebCore {
         static bool attributeIsCSS(const String& attributeName);
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
- 
         enum CalcMode { CalcModeDiscrete, CalcModeLinear, CalcModePaced, CalcModeSpline };
         CalcMode calcMode() const;
         
@@ -109,6 +105,11 @@ namespace WebCore {
         float calculatePercentForSpline(float percent, unsigned splineIndex) const;
         
     protected:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAnimationElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         bool m_animationValid;
 
         Vector<String> m_values;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
index 0c48f51..2329299 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.cpp
@@ -41,6 +41,7 @@ SVGCircleElement::SVGCircleElement(const QualifiedName& tagName, Document* doc)
     , m_cx(this, SVGNames::cxAttr, LengthModeWidth)
     , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
     , m_r(this, SVGNames::rAttr, LengthModeOther)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
index 598e51f..69b015d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCircleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,13 +45,17 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cxAttrString, SVGLength, Cx, cx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::rAttrString, SVGLength, R, r)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
index 691e4d5..bbeac91 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.cpp
@@ -40,6 +40,7 @@ SVGClipPathElement::SVGClipPathElement(const QualifiedName& tagName, Document* d
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_clipPathUnits(this, SVGNames::clipPathUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
index 4043554..6079159 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGClipPathElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,12 +47,14 @@ namespace WebCore {
 
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGNames::clipPathTagString, SVGNames::clipPathUnitsAttrString, int, ClipPathUnits, clipPathUnits)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         RefPtr<SVGResourceClipper> m_clipper;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
index 12e9e5d..b282aa3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.cpp
@@ -40,6 +40,8 @@ SVGCursorElement::SVGCursorElement(const QualifiedName& tagName, Document* doc)
     , SVGURIReference()
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
index ddafb76..ee919a4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGCursorElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -50,13 +48,18 @@ namespace WebCore {
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::yAttrString, SVGLength, Y, y)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         HashSet<SVGElement*> m_clients;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
index b084bb2..c03c09b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.cpp
@@ -34,6 +34,7 @@ SVGDefsElement::SVGDefsElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
index c4cac62..4bb206e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDefsElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -43,8 +41,11 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGDefsElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
index 2169dd6..a16493a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2008 Alp Toker <alp@atoker.com>
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -77,16 +78,6 @@ bool SVGElement::isSupported(StringImpl* feature, StringImpl* version) const
     return DOMImplementation::hasFeature(feature, version);
 }
 
-String SVGElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void SVGElement::setId(const String& value, ExceptionCode&)
-{
-    setAttribute(idAttr, value);
-}
-
 String SVGElement::xmlbase() const
 {
     return getAttribute(XMLNames::baseAttr);
@@ -243,7 +234,7 @@ void SVGElement::insertedIntoDocument()
     StyledElement::insertedIntoDocument();
     SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
 
-    String resourceId = SVGURIReference::getTarget(id());
+    String resourceId = SVGURIReference::getTarget(getAttribute(idAttr));
     if (extensions->isPendingResource(resourceId)) {
         std::auto_ptr<HashSet<SVGStyledElement*> > clients(extensions->removePendingResource(resourceId));
         if (clients->isEmpty())
@@ -279,10 +270,10 @@ void SVGElement::updateAnimatedSVGAttribute(const String& name) const
     m_synchronizingSVGAttributes = true;
 
     if (name.isEmpty()) {
-        invokeAllSVGPropertySynchronizers();
+        m_propertyController.synchronizeAllProperties();
         setSynchronizedSVGAttributes(true);
     } else
-        invokeSVGPropertySynchronizer(name);
+        m_propertyController.synchronizeProperty(name);
 
     m_synchronizingSVGAttributes = false;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
index 3a17567..b247a74 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "StyledElement.h"
 #include "SVGAnimatedProperty.h"
+#include "SynchronizablePropertyController.h"
 
 namespace WebCore {
 
@@ -41,8 +42,6 @@ namespace WebCore {
         static PassRefPtr<SVGElement> create(const QualifiedName&, Document*);
         virtual ~SVGElement();
 
-        String id() const;
-        void setId(const String&, ExceptionCode&);
         String xmlbase() const;
         void setXmlbase(const String&, ExceptionCode&);
 
@@ -79,14 +78,11 @@ namespace WebCore {
 
         HashSet<SVGElementInstance*> instancesForElement() const;
 
-        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
-        {
-            m_svgPropertyMap.set(attrName.localName(), &base);
-        }
-
         void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
         void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
 
+        SynchronizablePropertyController& propertyController() const { return m_propertyController; }
+
     protected:
         SVGElement(const QualifiedName&, Document*);
 
@@ -108,36 +104,13 @@ namespace WebCore {
 
         virtual void buildPendingResource() { }
 
-        // Inlined methods handling SVG property synchronization
-        void invokeSVGPropertySynchronizer(const String& name) const
-        {
-            if (m_svgPropertyMap.contains(name)) {
-                const SVGAnimatedPropertyBase* property = m_svgPropertyMap.get(name);
-                ASSERT(property);
-
-                property->synchronize();
-            }
-        }
-
-        void invokeAllSVGPropertySynchronizers() const
-        {
-            HashMap<String, const SVGAnimatedPropertyBase*>::const_iterator it = m_svgPropertyMap.begin();
-            const HashMap<String, const SVGAnimatedPropertyBase*>::const_iterator end = m_svgPropertyMap.end();
-            for (; it != end; ++it) {
-                const SVGAnimatedPropertyBase* property = it->second;
-                ASSERT(property);
-
-                property->synchronize();
-            }
-        }
-
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
         virtual bool haveLoadedRequiredResources();
 
         ContainerNode* m_shadowParent;
-        mutable HashMap<String, const SVGAnimatedPropertyBase*> m_svgPropertyMap;
+        mutable SynchronizablePropertyController m_propertyController;
 
         SVGCursorElement* m_cursorElement;
         CSSCursorImageValue* m_cursorImageValue;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
index a1f331f..e4112c1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.idl
@@ -25,7 +25,7 @@
 module svg {
 
     interface [GenerateNativeConverter, Conditional=SVG] SVGElement : Element {
-                 attribute [ConvertNullToNullString] DOMString id
+                 attribute [ConvertNullToNullString, Reflect] DOMString id
                      setter raises(DOMException);
                  attribute [ConvertNullToNullString] DOMString xmlbase
                      setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
index 6d56ff8..4c67ff3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.cpp
@@ -42,6 +42,7 @@ SVGEllipseElement::SVGEllipseElement(const QualifiedName& tagName, Document* doc
     , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
     , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
     , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }    
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
index 8c7d3a1..5b54fd5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGEllipseElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,7 +45,6 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -55,6 +52,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
index 640f92e..201ecbf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 char SVGExternalResourcesRequiredIdentifier[] = "SVGExternalResourcesRequired";
 
 SVGExternalResourcesRequired::SVGExternalResourcesRequired()
-    : m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
index e491e4b..f088c82 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,16 +30,11 @@ namespace WebCore {
     extern char SVGExternalResourcesRequiredIdentifier[];
     class MappedAttribute;
 
-    // FIXME: This is wrong for several reasons:
-    // 1. externalResourcesRequired is not animateable according to SVG 1.1 section 5.9
-    // 2. externalResourcesRequired should just be part of SVGElement, and default to "false" for all elements
-    /*
-     SPEC: Note that the SVG DOM 
-     defines the attribute externalResourcesRequired as being of type SVGAnimatedBoolean, whereas the 
-     SVG language definition says that externalResourcesRequired is not animated. Because the SVG 
-     language definition states that externalResourcesRequired cannot be animated, the animVal will 
-     always be the same as the baseVal.
-     */
+    // Notes on a SVG 1.1 spec discrepancy:
+    // The SVG DOM defines the attribute externalResourcesRequired as being of type SVGAnimatedBoolean, whereas the 
+    // SVG language definition says that externalResourcesRequired is not animated. Because the SVG language definition
+    // states that externalResourcesRequired cannot be animated, the animVal will always be the same as the baseVal.
+    // FIXME: When implementing animVal support, make sure that animVal==baseVal for externalResourcesRequired
     class SVGExternalResourcesRequired {
     public:
         SVGExternalResourcesRequired();
@@ -50,12 +43,8 @@ namespace WebCore {
         bool parseMappedAttribute(MappedAttribute*);
         bool isKnownAttribute(const QualifiedName&);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGExternalResourcesRequired, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+    protected:
+        virtual void setExternalResourcesRequiredBaseValue(SVGAnimatedTypeValue<bool>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
index 97a13fc..d317997 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFECompositeElement.idl
@@ -38,7 +38,7 @@ module svg {
 
         readonly attribute SVGAnimatedString      in1;
         readonly attribute SVGAnimatedString      in2;
-        readonly attribute SVGAnimatedEnumeration _operator;
+        readonly attribute SVGAnimatedEnumeration operator;
         readonly attribute SVGAnimatedNumber      k1;
         readonly attribute SVGAnimatedNumber      k2;
         readonly attribute SVGAnimatedNumber      k3;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
index ae5ce94..3d80799 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.cpp
@@ -34,7 +34,6 @@ namespace WebCore {
 
 SVGFEFloodElement::SVGFEFloodElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -42,28 +41,14 @@ SVGFEFloodElement::~SVGFEFloodElement()
 {
 }
 
-void SVGFEFloodElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    const String& value = attr->value();
-    if (attr->name() == SVGNames::inAttr)
-        setIn1BaseValue(value);
-    else
-        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
-}
-
 bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input = filterResource->builder()->getEffectById(in1());
-
-    if (!input)
-        return false;
-
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
 
     Color color = filterStyle->svgStyle()->floodColor();
     float opacity = filterStyle->svgStyle()->floodOpacity();
 
-    RefPtr<FilterEffect> effect = FEFlood::create(input, color, opacity);
+    RefPtr<FilterEffect> effect = FEFlood::create(color, opacity);
     filterResource->addFilterEffect(this, effect.release());
     
     return true;
@@ -71,6 +56,6 @@ bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 
 }
 
-#endif // ENABLE(SVG)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 // vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
index ca4e18b..e83fc94 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.h
@@ -33,14 +33,10 @@ namespace WebCore {
         SVGFEFloodElement(const QualifiedName&, Document*);
         virtual ~SVGFEFloodElement();
 
-        virtual void parseMappedAttribute(MappedAttribute*);
         virtual bool build(SVGResourceFilter*);
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEFloodElement, SVGNames::feFloodTagString, SVGNames::inAttrString, String, In1, in1)
     };
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
index 814bbdf..b3c3180 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEFloodElement.idl
@@ -27,8 +27,5 @@ module svg {
 
     interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEFloodElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
-
-        readonly attribute SVGAnimatedString      in1;
-
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
index 187c212..c9bb613 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -24,7 +24,7 @@
 #define SVGFEGaussianBlurElement_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
-#include "SVGFEGaussianBlur.h"
+#include "FEGaussianBlur.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
index 8122960..269d6b2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.cpp
@@ -43,6 +43,8 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
index 67f3bd5..7c6d89b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEImageElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,12 +47,17 @@ namespace WebCore {
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
         virtual bool build(SVGResourceFilter*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         CachedResourceHandle<CachedImage> m_cachedImage;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
index f6e79fb..92947a1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
@@ -39,9 +39,6 @@ namespace WebCore {
         virtual LightSource* lightSource() const = 0;
         virtual void parseMappedAttribute(MappedAttribute*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::azimuthAttrString, float, Azimuth, azimuth)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::elevationAttrString, float, Elevation, elevation)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
index cb3a781..8f4eed9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeElement.cpp
@@ -45,6 +45,8 @@ bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
             FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
+            if (!mergeEffect)
+                return false;
             mergeInputs.append(mergeEffect);
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
index 4633f98..cdec8d2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,9 +34,6 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEMergeNodeElement, SVGNames::feMergeNodeTagString, SVGNames::inAttrString, String, In1, in1)
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
new file mode 100644
index 0000000..4a06188
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.cpp
@@ -0,0 +1,88 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEMorphologyElement.h"
+
+#include "MappedAttribute.h"
+#include "SVGNames.h"
+#include "SVGParserUtilities.h"
+#include "SVGResourceFilter.h"
+
+namespace WebCore {
+
+char SVGRadiusXAttrIdentifier[] = "SVGRadiusXAttr";
+char SVGRadiusYAttrIdentifier[] = "SVGRadiusYAttr";
+
+SVGFEMorphologyElement::SVGFEMorphologyElement(const QualifiedName& tagName, Document* document)
+    : SVGFilterPrimitiveStandardAttributes(tagName, document)
+    , m_in1(this, SVGNames::inAttr)
+    , m__operator(this, SVGNames::operatorAttr, FEMORPHOLOGY_OPERATOR_ERODE)
+    , m_radiusX(this, SVGNames::radiusAttr)
+    , m_radiusY(this, SVGNames::radiusAttr)
+{
+}
+
+SVGFEMorphologyElement::~SVGFEMorphologyElement()
+{
+}
+
+void SVGFEMorphologyElement::setRadius(float, float)
+{
+    // FIXME: Needs an implementation.
+}
+
+void SVGFEMorphologyElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    const String& value = attr->value();
+    if (attr->name() == SVGNames::operatorAttr) {
+        if (value == "erode")
+            set_operatorBaseValue(FEMORPHOLOGY_OPERATOR_ERODE);
+        else if (value == "dilate")
+            set_operatorBaseValue(FEMORPHOLOGY_OPERATOR_DILATE);
+    } else if (attr->name() == SVGNames::inAttr)
+        setIn1BaseValue(value);
+    else if (attr->name() == SVGNames::radiusAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setRadiusXBaseValue(x);
+            setRadiusYBaseValue(y);
+        }
+    } else
+        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
+}
+
+bool SVGFEMorphologyElement::build(SVGResourceFilter* filterResource)
+{
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+
+    if (!input1)
+        return false;
+
+    RefPtr<FilterEffect> effect = FEMorphology::create(input1, static_cast<MorphologyOperatorType>(_operator()), radiusX(), radiusY());
+    filterResource->addFilterEffect(this, effect.release());
+    
+    return true;
+}
+
+} //namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
new file mode 100644
index 0000000..6c1aec1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.h
@@ -0,0 +1,52 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGFEMorphologyElement_h
+#define SVGFEMorphologyElement_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEMorphology.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+
+namespace WebCore {
+
+    extern char SVGRadiusXAttrIdentifier[];
+    extern char SVGRadiusYAttrIdentifier[];
+
+    class SVGFEMorphologyElement : public SVGFilterPrimitiveStandardAttributes {
+    public:
+        SVGFEMorphologyElement(const QualifiedName&, Document*);
+        virtual ~SVGFEMorphologyElement();
+
+        void setRadius(float radiusX, float radiusY);
+
+        virtual void parseMappedAttribute(MappedAttribute*);
+        virtual bool build(SVGResourceFilter*);
+
+    private:
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::inAttrString, String, In1, in1)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::operatorAttrString, int, _operator, _operator)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusXAttrIdentifier, float, RadiusX, radiusX)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusYAttrIdentifier, float, RadiusY, radiusY)
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
new file mode 100644
index 0000000..cce0e36
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMorphologyElement.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module svg {
+
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEMorphologyElement : SVGElement,
+                                                             SVGFilterPrimitiveStandardAttributes {
+        // Morphology Operators
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_UNKNOWN  = 0;
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_ERODE    = 1;
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_DILATE   = 2;
+
+        readonly attribute SVGAnimatedString      in1;
+        readonly attribute SVGAnimatedEnumeration operator;
+        readonly attribute SVGAnimatedNumber      radiusX;
+        readonly attribute SVGAnimatedNumber      radiusY;
+
+        void setRadius(in float radiusX, in float radiusY);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
index 7703b6f..db46179 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
     Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This file is part of the KDE project
 
@@ -54,6 +55,8 @@ SVGFilterElement::SVGFilterElement(const QualifiedName& tagName, Document* doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
     , m_filterResX(this, SVGNames::filterResAttr)
     , m_filterResY(this, SVGNames::filterResAttr)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -100,39 +103,36 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
-SVGResource* SVGFilterElement::canvasResource()
+void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
 {
-    if (!attached())
-        return 0;
-
-    if (!m_filter)
-        m_filter = new SVGResourceFilter();
-
     bool filterBBoxMode = filterUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
-    m_filter->setFilterBoundingBoxMode(filterBBoxMode);
-
-    float _x, _y, _width, _height;
-
-    if (filterBBoxMode) {
-        _x = x().valueAsPercentage();
-        _y = y().valueAsPercentage();
-        _width = width().valueAsPercentage();
-        _height = height().valueAsPercentage();
-    } else {
-        m_filter->setXBoundingBoxMode(x().unitType() == LengthTypePercentage);
-        m_filter->setYBoundingBoxMode(y().unitType() == LengthTypePercentage);
-
-        _x = x().value(this);
-        _y = y().value(this);
-        _width = width().value(this);
-        _height = height().value(this);
-    } 
-
-    m_filter->setFilterRect(FloatRect(_x, _y, _width, _height));
-
     bool primitiveBBoxMode = primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
+
+    FloatRect filterBBox;
+    if (filterBBoxMode)
+        filterBBox = FloatRect(x().valueAsPercentage(),
+                               y().valueAsPercentage(),
+                               width().valueAsPercentage(),
+                               height().valueAsPercentage());
+    else
+        filterBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    FloatRect filterRect = filterBBox;
+    if (filterBBoxMode)
+        filterRect = FloatRect(targetRect.x() + filterRect.x() * targetRect.width(),
+                               targetRect.y() + filterRect.y() * targetRect.height(),
+                               filterRect.width() * targetRect.width(),
+                               filterRect.height() * targetRect.height());
+
+    m_filter->setFilterBoundingBox(filterRect);
+    m_filter->setFilterRect(filterBBox);
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
+    m_filter->setFilterBoundingBoxMode(filterBBoxMode);
 
+    // Add effects to the filter
     m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         SVGElement* element = 0;
@@ -147,12 +147,18 @@ SVGResource* SVGFilterElement::canvasResource()
             }
         }
     }
+}
 
+SVGResource* SVGFilterElement::canvasResource()
+{
+    if (!attached())
+        return 0;
+
+    if (!m_filter)
+        m_filter = SVGResourceFilter::create(this);
     return m_filter.get();
 }
 
 }
 
-#endif // ENABLE(SVG)
-
-// vim:ts=4:noet
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
index 541ec14..836c689 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterElement.h
@@ -3,8 +3,6 @@
     Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,9 +49,6 @@ namespace WebCore {
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::filterUnitsAttrString, int, FilterUnits, filterUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::primitiveUnitsAttrString, int, PrimitiveUnits, primitiveUnits)
@@ -64,7 +59,19 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResXIdentifier, long, FilterResX, filterResX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResYIdentifier, long, FilterResY, filterResY)
 
-        RefPtr<SVGResourceFilter> m_filter;
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        mutable RefPtr<SVGResourceFilter> m_filter;
+
+    private:
+        friend class SVGResourceFilter;
+        void buildFilter(const FloatRect& targetRect) const;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 3eeb625..67c8bff 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -77,8 +76,6 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
 
     ASSERT(resourceFilter);
 
-    float _x, _y, _width, _height;
-
     if (this->hasAttribute(SVGNames::xAttr))
         filterEffect->setHasX(true);
     if (this->hasAttribute(SVGNames::yAttr))
@@ -88,47 +85,19 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
     if (this->hasAttribute(SVGNames::heightAttr))
         filterEffect->setHasHeight(true);
 
-    if (resourceFilter->effectBoundingBoxMode()) {
-        _x = x().valueAsPercentage();
-        _y = y().valueAsPercentage();
-        _width = width().valueAsPercentage();
-        _height = height().valueAsPercentage();
-    } else {
-        // We need to resolve any percentages in filter rect space.
-        if (x().unitType() == LengthTypePercentage) {
-            filterEffect->setXBoundingBoxMode(true);
-            _x = x().valueAsPercentage();
-        } else {
-            filterEffect->setXBoundingBoxMode(false);
-            _x = x().value(this);
-        }
-
-        if (y().unitType() == LengthTypePercentage) {
-            filterEffect->setYBoundingBoxMode(true);
-            _y = y().valueAsPercentage();
-        } else {
-            filterEffect->setYBoundingBoxMode(false);
-            _y = y().value(this);
-        }
-
-        if (width().unitType() == LengthTypePercentage) {
-            filterEffect->setWidthBoundingBoxMode(true);
-            _width = width().valueAsPercentage();
-        } else {
-            filterEffect->setWidthBoundingBoxMode(false);
-            _width = width().value(this);
-        }
-
-        if (height().unitType() == LengthTypePercentage) {
-            filterEffect->setHeightBoundingBoxMode(true);
-            _height = height().valueAsPercentage();
-        } else {
-            filterEffect->setHeightBoundingBoxMode(false);
-            _height = height().value(this);
-        }
-    }
-
-    filterEffect->setSubRegion(FloatRect(_x, _y, _width, _height));
+    FloatRect effectBBox;
+    if (resourceFilter->effectBoundingBoxMode())
+        effectBBox = FloatRect(x().valueAsPercentage(),
+                               y().valueAsPercentage(),
+                               width().valueAsPercentage(),
+                               height().valueAsPercentage());
+    else
+        effectBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    filterEffect->setSubRegion(effectBBox);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index 3cdbb37..cb8ec1c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -50,7 +48,6 @@ namespace WebCore {
     protected:
         friend class SVGResourceFilter;
         void setStandardAttributes(SVGResourceFilter*, FilterEffect*) const;
-        virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::xAttrString, SVGLength, X, x)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
index 847038c..c566a8f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGFitToViewBox.h"
 
+#include "Attr.h"
 #include "Document.h"
 #include "FloatRect.h"
 #include "MappedAttribute.h"
@@ -39,8 +38,6 @@ namespace WebCore {
 char SVGFitToViewBoxIdentifier[] = "SVGFitToViewBox";
 
 SVGFitToViewBox::SVGFitToViewBox()
-    : m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -48,9 +45,8 @@ SVGFitToViewBox::~SVGFitToViewBox()
 {
 }
 
-bool SVGFitToViewBox::parseViewBox(const UChar*& c, const UChar* end, float& x, float& y, float& w, float& h, bool validate)
+bool SVGFitToViewBox::parseViewBox(Document* doc, const UChar*& c, const UChar* end, float& x, float& y, float& w, float& h, bool validate)
 {
-    Document* doc = contextElement()->document();
     String str(c, end - c);
 
     skipOptionalSpaces(c, end);
@@ -81,24 +77,22 @@ bool SVGFitToViewBox::parseViewBox(const UChar*& c, const UChar* end, float& x,
     return true;
 }
 
-TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio* preserveAspectRatio, float viewWidth, float viewHeight)
 {
-    FloatRect viewBoxRect = viewBox();
+    ASSERT(preserveAspectRatio);
     if (!viewBoxRect.width() || !viewBoxRect.height())
         return TransformationMatrix();
 
-    return preserveAspectRatio()->getCTM(viewBoxRect.x(),
-            viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(),
-            0, 0, viewWidth, viewHeight);
+    return preserveAspectRatio->getCTM(viewBoxRect.x(), viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(), 0, 0, viewWidth, viewHeight);
 }
 
-bool SVGFitToViewBox::parseMappedAttribute(MappedAttribute* attr)
+bool SVGFitToViewBox::parseMappedAttribute(Document* document, MappedAttribute* attr)
 {
     if (attr->name() == SVGNames::viewBoxAttr) {
         float x = 0.0f, y = 0.0f, w = 0.0f, h = 0.0f;
         const UChar* c = attr->value().characters();
         const UChar* end = c + attr->value().length();
-        if (parseViewBox(c, end, x, y, w, h))
+        if (parseViewBox(document, c, end, x, y, w, h))
             setViewBoxBaseValue(FloatRect(x, y, w, h));
         return true;
     } else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
index ac03df4..503a0ef 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFitToViewBox.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,17 +36,17 @@ namespace WebCore {
         SVGFitToViewBox();
         virtual ~SVGFitToViewBox();
 
-        bool parseViewBox(const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
-        virtual TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        bool parseViewBox(Document*, const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
+        static TransformationMatrix viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio*, float viewWidth, float viewHeight);
 
-        bool parseMappedAttribute(MappedAttribute*);
+        bool parseMappedAttribute(Document*, MappedAttribute*);
         bool isKnownAttribute(const QualifiedName&);
 
-        virtual const SVGElement* contextElement() const = 0;
+    protected:
+        virtual SVGAnimatedTypeValue<FloatRect>::DecoratedType viewBoxBaseValue() const = 0;
+        virtual void setViewBoxBaseValue(SVGAnimatedTypeValue<FloatRect>::DecoratedType type) = 0;
 
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFitToViewBox, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFitToViewBox, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        virtual SVGAnimatedTypeValue<SVGPreserveAspectRatio>::DecoratedType preserveAspectRatioBaseValue() const = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
index 98321f4..7d62b8c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.cpp
@@ -39,7 +39,8 @@ namespace WebCore {
 using namespace SVGNames;
 
 SVGFontElement::SVGFontElement(const QualifiedName& tagName, Document* doc)
-    : SVGStyledElement(tagName, doc)
+    : SVGStyledElement(tagName, doc) 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_isGlyphCacheValid(false)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
index 42468da..1fc5136 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontElement.h
@@ -47,10 +47,12 @@ namespace WebCore {
 
         SVGMissingGlyphElement* firstMissingGlyphElement() const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFontElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         void ensureGlyphCache() const;
 
         typedef Vector<SVGHorizontalKerningPair> KerningPairVector;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
index 5cfca8a..1e75741 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp
@@ -43,6 +43,8 @@ SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, D
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
index 14dbe68..1848e2b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Apple Computer, Inc.
 
-    This file is part of the WebKit project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -48,14 +46,19 @@ namespace WebCore {
         bool childShouldCreateRenderer(Node*) const;
         virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::yAttrString, SVGLength, Y, y)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
index 2b50d74..241f264 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGElement.cpp
@@ -34,6 +34,7 @@ SVGGElement::SVGGElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
index 8e3b368..9cfb5a3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,10 +45,12 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         friend class SVGUseElement;
         TransformationMatrix localMatrix() const;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
index 8034286..93e2cb4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.cpp
@@ -48,6 +48,8 @@ SVGGradientElement::SVGGradientElement(const QualifiedName& tagName, Document* d
     , m_spreadMethod(this, SVGNames::spreadMethodAttr)
     , m_gradientUnits(this, SVGNames::gradientUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_gradientTransform(this, SVGNames::gradientTransformAttr, SVGTransformList::create(SVGNames::gradientTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
index 2027258..8413597 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,12 +58,18 @@ namespace WebCore {
         Vector<SVGGradientStop> buildStops() const;
         mutable RefPtr<SVGPaintServerGradient> m_resource;
  
-        virtual const SVGElement* contextElement() const { return this; }
-
     protected:
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::spreadMethodAttrString, int, SpreadMethod, spreadMethod)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientUnitsAttrString, int, GradientUnits, gradientUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientTransformAttrString, SVGTransformList, GradientTransform, gradientTransform)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index 299828f..e29846c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -45,7 +45,9 @@ SVGImageElement::SVGImageElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create()) 
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_imageLoader(this)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
index 1d242b5..1bdcdba 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -61,7 +59,6 @@ namespace WebCore {
     protected:
         virtual bool haveLoadedRequiredResources();
         virtual bool hasRelativeValues() const;
-        virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::xAttrString, SVGLength, X, x)
@@ -70,6 +67,14 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         SVGImageLoader m_imageLoader;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
index cb31178..4f7b7e5 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.cpp
@@ -42,6 +42,7 @@ SVGLineElement::SVGLineElement(const QualifiedName& tagName, Document* doc)
     , m_y1(this, SVGNames::y1Attr, LengthModeHeight)
     , m_x2(this, SVGNames::x2Attr, LengthModeWidth)
     , m_y2(this, SVGNames::y2Attr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
index 2d89f5c..a24e009 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLineElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,7 +49,6 @@ namespace WebCore {
         virtual bool supportsMarkers() const { return true; }
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -59,6 +56,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y1AttrString, SVGLength, Y1, y1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::x2AttrString, SVGLength, X2, x2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y2AttrString, SVGLength, Y2, y2)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
index 9927a50..f5c8cee 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGLinearGradientElement.cpp
@@ -84,8 +84,15 @@ void SVGLinearGradientElement::buildGradient() const
 
     RefPtr<SVGPaintServerLinearGradient> linearGradient = WTF::static_pointer_cast<SVGPaintServerLinearGradient>(m_resource);
 
-    FloatPoint startPoint = FloatPoint::narrowPrecision(attributes.x1(), attributes.y1());
-    FloatPoint endPoint = FloatPoint::narrowPrecision(attributes.x2(), attributes.y2());
+    FloatPoint startPoint;
+    FloatPoint endPoint;
+    if (attributes.boundingBoxMode()) {
+        startPoint = FloatPoint(attributes.x1().valueAsPercentage(), attributes.y1().valueAsPercentage());
+        endPoint = FloatPoint(attributes.x2().valueAsPercentage(), attributes.y2().valueAsPercentage());
+    } else {
+        startPoint = FloatPoint(attributes.x1().value(this), attributes.y1().value(this));
+        endPoint = FloatPoint(attributes.x2().value(this), attributes.y2().value(this));
+    }
 
     RefPtr<Gradient> gradient = Gradient::create(startPoint, endPoint);
     gradient->setSpreadMethod(attributes.spreadMethod());
@@ -142,16 +149,16 @@ LinearGradientAttributes SVGLinearGradientElement::collectGradientProperties() c
             const SVGLinearGradientElement* linear = static_cast<const SVGLinearGradientElement*>(current);
 
             if (!attributes.hasX1() && current->hasAttribute(SVGNames::x1Attr))
-                attributes.setX1(linear->x1().valueAsPercentage());
+                attributes.setX1(linear->x1());
 
             if (!attributes.hasY1() && current->hasAttribute(SVGNames::y1Attr))
-                attributes.setY1(linear->y1().valueAsPercentage());
+                attributes.setY1(linear->y1());
 
             if (!attributes.hasX2() && current->hasAttribute(SVGNames::x2Attr))
-                attributes.setX2(linear->x2().valueAsPercentage());
+                attributes.setX2(linear->x2());
 
             if (!attributes.hasY2() && current->hasAttribute(SVGNames::y2Attr))
-                attributes.setY2(linear->y2().valueAsPercentage());
+                attributes.setY2(linear->y2());
         }
 
         processedGradients.add(current);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
index b3214ed..b8c862a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.cpp
@@ -31,6 +31,8 @@ namespace WebCore {
 
 SVGMPathElement::SVGMPathElement(const QualifiedName& qname, Document* doc)
     : SVGElement(qname, doc)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -47,7 +49,7 @@ void SVGMPathElement::parseMappedAttribute(MappedAttribute* attr)
 
 SVGPathElement* SVGMPathElement::pathElement()
 {
-    Element* target = document()->getElementById(getTarget(SVGURIReference::href()));
+    Element* target = document()->getElementById(getTarget(href()));
     if (target && target->hasTagName(SVGNames::pathTag))
         return static_cast<SVGPathElement*>(target);
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
index 988cead..ded6cdf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMPathElement.h
@@ -1,28 +1,26 @@
 /*
- Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- 
- This file is part of the WebKit project
- 
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; either
- version 2 of the License, or (at your option) any later version.
- 
- This library is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
- 
- You should have received a copy of the GNU Library General Public License
- along with this library; see the file COPYING.LIB.  If not, write to
- the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- */
+    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
 
 #ifndef SVGMPathElement_h
 #define SVGMPathElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGURIReference.h"
 #include "SVGExternalResourcesRequired.h"
 
@@ -31,8 +29,8 @@ namespace WebCore {
     class SVGPathElement;
     
     class SVGMPathElement : public SVGElement,
-                                   SVGURIReference,
-                                   SVGExternalResourcesRequired {
+                            public SVGURIReference,
+                            public SVGExternalResourcesRequired {
     public:
         SVGMPathElement(const QualifiedName&, Document*);
         virtual ~SVGMPathElement();
@@ -41,13 +39,17 @@ namespace WebCore {
         
         SVGPathElement* pathElement();
         
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif // SVGMPathElement_h
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
index b09e718..2e96926 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
@@ -50,6 +50,9 @@ SVGMarkerElement::SVGMarkerElement(const QualifiedName& tagName, Document* doc)
     , m_markerUnits(this, SVGNames::markerUnitsAttr, SVG_MARKERUNITS_STROKEWIDTH)
     , m_orientType(this, SVGNames::orientAttr, SVG_MARKER_ORIENT_ANGLE)
     , m_orientAngle(this, SVGNames::orientAttr, SVGAngle::create())
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
     // Spec: If the markerWidth/markerHeight attribute is not specified, the effect is as if a value of "3" were specified.
 }
@@ -63,6 +66,11 @@ SVGMarkerElement::~SVGMarkerElement()
         detach();
 }
 
+TransformationMatrix SVGMarkerElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+{
+    return SVGFitToViewBox::viewBoxToViewTransform(viewBox(), preserveAspectRatio(), viewWidth, viewHeight);
+}
+
 void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == SVGNames::markerUnitsAttr) {
@@ -94,7 +102,7 @@ void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
 
         SVGStyledElement::parseMappedAttribute(attr);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
index e2e3493..7e08a96 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.h
@@ -58,6 +58,8 @@ namespace WebCore {
         SVGMarkerElement(const QualifiedName&, Document*);
         virtual ~SVGMarkerElement();
 
+        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+
         void setOrientToAuto();
         void setOrientToAngle(PassRefPtr<SVGAngle>);
 
@@ -68,9 +70,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refXAttrString, SVGLength, RefX, refX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refYAttrString, SVGLength, RefY, refY)
@@ -80,6 +79,15 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientTypeAttrIdentifier, int, OrientType, orientType)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientAngleAttrIdentifier, SVGAngle, OrientAngle, orientAngle)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         RefPtr<SVGResourceMarker> m_marker;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
index 6b75527..127f6f4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
@@ -55,6 +55,8 @@ SVGMaskElement::SVGMaskElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight, "-10%")
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -128,45 +130,45 @@ void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, N
 PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
 {    
     // Determine specified mask size
-    float xValue;
-    float yValue;
-    float widthValue;
-    float heightValue;
-
-    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
-        xValue = x().valueAsPercentage() * targetRect.width();
-        yValue = y().valueAsPercentage() * targetRect.height();
-        widthValue = width().valueAsPercentage() * targetRect.width();
-        heightValue = height().valueAsPercentage() * targetRect.height();
-    } else {
-        xValue = x().value(this);
-        yValue = y().value(this);
-        widthValue = width().value(this);
-        heightValue = height().value(this);
-    } 
-
-    IntSize imageSize(lroundf(widthValue), lroundf(heightValue));
+    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        maskDestRect = FloatRect(x().valueAsPercentage() * targetRect.width(),
+                                 y().valueAsPercentage() * targetRect.height(),
+                                 width().valueAsPercentage() * targetRect.width(),
+                                 height().valueAsPercentage() * targetRect.height());
+    else
+        maskDestRect = FloatRect(x().value(this),
+                                 y().value(this),
+                                 width().value(this),
+                                 height().value(this));
+
+    IntSize imageSize(lroundf(maskDestRect.width()), lroundf(maskDestRect.height()));
     clampImageBufferSizeToViewport(document()->view(), imageSize);
 
-    if (imageSize.width() < static_cast<int>(widthValue))
-        widthValue = imageSize.width();
+    if (imageSize.width() < static_cast<int>(maskDestRect.width()))
+        maskDestRect.setWidth(imageSize.width());
 
-    if (imageSize.height() < static_cast<int>(heightValue))
-        heightValue = imageSize.height();
+    if (imageSize.height() < static_cast<int>(maskDestRect.height()))
+        maskDestRect.setHeight(imageSize.height());
 
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize);
+    // FIXME: This changes color space to linearRGB, the default color space
+    // for masking operations in SVG. We need a switch for the other color-space
+    // attribute values sRGB, inherit and auto.
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, LinearRGB);
     if (!maskImage)
         return 0;
 
-    maskDestRect = FloatRect(xValue, yValue, widthValue, heightValue);
+    FloatPoint maskContextLocation = maskDestRect.location();
     if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
         maskDestRect.move(targetRect.x(), targetRect.y());
 
+    if (maskContentUnits() != SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        maskContextLocation.move(targetRect.x(), targetRect.y());
+
     GraphicsContext* maskImageContext = maskImage->context();
     ASSERT(maskImageContext);
 
     maskImageContext->save();
-    maskImageContext->translate(-xValue, -yValue);
+    maskImageContext->translate(-maskContextLocation.x(), -maskContextLocation.y());
 
     if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
         maskImageContext->save();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
index f2b7ae5..362c730 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2005 Alexander Kellett <lypanov@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -54,9 +52,6 @@ namespace WebCore {
 
         PassOwnPtr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskUnitsAttrString, int, MaskUnits, maskUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskContentUnitsAttrString, int, MaskContentUnits, maskContentUnits)
@@ -65,6 +60,14 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         RefPtr<SVGResourceMasker> m_masker;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
index 172cac1..7079929 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.cpp
@@ -50,6 +50,7 @@ SVGPathElement::SVGPathElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_pathLength(this, SVGNames::pathLengthAttr, 0.0f)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
index 362a85b..7ea010b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPathElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -99,13 +97,15 @@ namespace WebCore {
 
         virtual bool supportsMarkers() const { return true; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         mutable RefPtr<SVGPathSegList> m_pathSegList;
 
         ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGNames::pathTagString, SVGNames::pathLengthAttrString, float, PathLength, pathLength)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
index befca85..34b7db4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
@@ -64,6 +64,10 @@ SVGPatternElement::SVGPatternElement(const QualifiedName& tagName, Document* doc
     , m_patternUnits(this, SVGNames::patternUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_patternContentUnits(this, SVGNames::patternContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
     , m_patternTransform(this, SVGNames::patternTransformAttr, SVGTransformList::create(SVGNames::patternTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -110,7 +114,7 @@ void SVGPatternElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
 
         SVGStyledElement::parseMappedAttribute(attr);
@@ -195,7 +199,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
         }
     }
 
-    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(patternBoundaries.width(), patternBoundaries.height()); 
+    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(viewBox(), preserveAspectRatio(), patternBoundaries.width(), patternBoundaries.height()); 
     FloatRect patternBoundariesIncludingOverflow = patternBoundaries;
 
     // Apply objectBoundingBoxMode fixup for patternContentUnits, if viewBox is not set.
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
index 2e6399c..6a679af 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -58,9 +56,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::yAttrString, SVGLength, Y, y)
@@ -70,6 +65,18 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternContentUnitsAttrString, int, PatternContentUnits, patternContentUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternTransformAttrString, SVGTransformList, PatternTransform, patternTransform)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGPatternElement
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         mutable RefPtr<SVGPaintServerPattern> m_resource;
 
     private:
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
index db39c52..62e53a3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.cpp
@@ -42,6 +42,7 @@ SVGPolyElement::SVGPolyElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGAnimatedPoints()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -117,7 +118,7 @@ void SVGPolyElement::updateAnimatedSVGAttribute(const String& name) const
     if (name == SVGNames::pointsAttr.localName()) {
         m_synchronizingSVGAttributes = true;
 
-        synchronizeProperty<SVGPolyElement, SVGPointList*>(this, SVGNames::pointsAttr, m_points.get());
+        PropertySynchronizer<SVGPolyElement, SVGPointList*, true>::synchronize(this, SVGNames::pointsAttr, m_points.get());
         setSynchronizedSVGAttributes(true);
         m_synchronizingSVGAttributes = false;
         return;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
index 8dd16cd..2ffd150 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPolyElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -54,10 +52,12 @@ namespace WebCore {
 
         virtual void updateAnimatedSVGAttribute(const String&) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPolyElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         mutable RefPtr<SVGPointList> m_points;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
index 23a8579..a9b5cff 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRadialGradientElement.cpp
@@ -92,29 +92,39 @@ void SVGRadialGradientElement::buildGradient() const
 
     RefPtr<SVGPaintServerRadialGradient> radialGradient = WTF::static_pointer_cast<SVGPaintServerRadialGradient>(m_resource);
 
-    double adjustedFocusX = attributes.fx();
-    double adjustedFocusY = attributes.fy();
+    FloatPoint focalPoint;
+    FloatPoint centerPoint;
+    float radius;
+    if (attributes.boundingBoxMode()) {
+        focalPoint = FloatPoint(attributes.fx().valueAsPercentage(), attributes.fy().valueAsPercentage());
+        centerPoint = FloatPoint(attributes.cx().valueAsPercentage(), attributes.cy().valueAsPercentage());
+        radius = attributes.r().valueAsPercentage();
+    } else {
+        focalPoint = FloatPoint(attributes.fx().value(this), attributes.fy().value(this));
+        centerPoint = FloatPoint(attributes.cx().value(this), attributes.cy().value(this));
+        radius = attributes.r().value(this);
+    }
+
+    float adjustedFocusX = focalPoint.x();
+    float adjustedFocusY = focalPoint.y();
 
-    double fdx = attributes.fx() - attributes.cx();
-    double fdy = attributes.fy() - attributes.cy();
+    float fdx = focalPoint.x() - centerPoint.x();
+    float fdy = focalPoint.y() - centerPoint.y();
 
     // Spec: If (fx, fy) lies outside the circle defined by (cx, cy) and
     // r, set (fx, fy) to the point of intersection of the line through
     // (fx, fy) and the circle.
-    if (sqrt(fdx * fdx + fdy * fdy) > attributes.r()) {
-        double angle = atan2(attributes.fy() * 100.0, attributes.fx() * 100.0);
-        adjustedFocusX = cos(angle) * attributes.r();
-        adjustedFocusY = sin(angle) * attributes.r();
+    if (sqrt(fdx * fdx + fdy * fdy) > radius) {
+        float angle = atan2f(focalPoint.y() * 100.0f, focalPoint.x() * 100.0f);
+        adjustedFocusX = cosf(angle) * radius;
+        adjustedFocusY = sinf(angle) * radius;
     }
 
-    FloatPoint focalPoint = FloatPoint::narrowPrecision(attributes.fx(), attributes.fy());
-    FloatPoint centerPoint = FloatPoint::narrowPrecision(attributes.cx(), attributes.cy());
-
     RefPtr<Gradient> gradient = Gradient::create(
-        FloatPoint::narrowPrecision(adjustedFocusX, adjustedFocusY),
+        FloatPoint(adjustedFocusX, adjustedFocusY),
         0.f, // SVG does not support a "focus radius"
         centerPoint,
-        narrowPrecisionToFloat(attributes.r()));
+        radius);
     gradient->setSpreadMethod(attributes.spreadMethod());
 
     Vector<SVGGradientStop> stops = attributes.stops();
@@ -134,7 +144,7 @@ void SVGRadialGradientElement::buildGradient() const
     radialGradient->setGradientTransform(attributes.gradientTransform());
     radialGradient->setGradientCenter(centerPoint);
     radialGradient->setGradientFocal(focalPoint);
-    radialGradient->setGradientRadius(narrowPrecisionToFloat(attributes.r()));
+    radialGradient->setGradientRadius(radius);
     radialGradient->setGradientStops(attributes.stops());
 }
 
@@ -166,19 +176,19 @@ RadialGradientAttributes SVGRadialGradientElement::collectGradientProperties() c
             const SVGRadialGradientElement* radial = static_cast<const SVGRadialGradientElement*>(current);
 
             if (!attributes.hasCx() && current->hasAttribute(SVGNames::cxAttr))
-                attributes.setCx(radial->cx().valueAsPercentage());
+                attributes.setCx(radial->cx());
 
             if (!attributes.hasCy() && current->hasAttribute(SVGNames::cyAttr))
-                attributes.setCy(radial->cy().valueAsPercentage());
+                attributes.setCy(radial->cy());
 
             if (!attributes.hasR() && current->hasAttribute(SVGNames::rAttr))
-                attributes.setR(radial->r().valueAsPercentage());
+                attributes.setR(radial->r());
 
             if (!attributes.hasFx() && current->hasAttribute(SVGNames::fxAttr))
-                attributes.setFx(radial->fx().valueAsPercentage());
+                attributes.setFx(radial->fx());
 
             if (!attributes.hasFy() && current->hasAttribute(SVGNames::fyAttr))
-                attributes.setFy(radial->fy().valueAsPercentage());
+                attributes.setFy(radial->fy());
         }
 
         processedGradients.add(current);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
index bfb6205..966976a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.cpp
@@ -43,6 +43,7 @@ SVGRectElement::SVGRectElement(const QualifiedName& tagName, Document *doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
     , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
     , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
index 2937c23..a4d859e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGRectElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,7 +45,6 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -57,6 +54,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
index 29e72b8..2d5008b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
@@ -66,7 +66,10 @@ SVGSVGElement::SVGSVGElement(const QualifiedName& tagName, Document* doc)
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "100%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%")
+    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%") 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
     , m_useCurrentView(false)
     , m_timeContainer(SMILTimeContainer::create(this))
     , m_viewSpec(0)
@@ -261,7 +264,7 @@ void SVGSVGElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
         if (SVGZoomAndPan::parseMappedAttribute(attr))
             return;
@@ -513,13 +516,8 @@ TransformationMatrix SVGSVGElement::viewBoxToViewTransform(float viewWidth, floa
             viewBoxRect = currentView()->viewBox();
     } else
         viewBoxRect = viewBox();
-    if (!viewBoxRect.width() || !viewBoxRect.height())
-        return TransformationMatrix();
-
-    TransformationMatrix ctm = preserveAspectRatio()->getCTM(viewBoxRect.x(),
-            viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(),
-            0, 0, viewWidth, viewHeight);
 
+    TransformationMatrix ctm = SVGFitToViewBox::viewBoxToViewTransform(viewBoxRect, preserveAspectRatio(), viewWidth, viewHeight);
     if (useCurrentView() && currentView())
         return currentView()->transform()->concatenate().matrix() * ctm;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
index 223ebf6..f30e8f6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -128,13 +126,11 @@ namespace WebCore {
 
         virtual void svgAttributeChanged(const QualifiedName&);
 
-        virtual TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
 
         void inheritViewAttributes(SVGViewElement*);
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
         friend class RenderSVGRoot;
         friend class RenderSVGViewportContainer;
 
@@ -148,6 +144,15 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         virtual void documentWillBecomeInactive();
         virtual void documentDidBecomeActive();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
index 587542c..c2f4a6e 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.cpp
@@ -37,6 +37,8 @@ SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* doc,
     : SVGElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
+    , m_href(this, XLinkNames::hrefAttr) 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_data(this, this)
 {
     m_data.setCreatedByParser(createdByParser);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
index f2efc8e..699c535 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGScriptElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,7 +58,6 @@ namespace WebCore {
         virtual bool shouldExecuteAsJavaScript() const { return false; }
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool haveLoadedRequiredResources();
 
         virtual String sourceAttributeValue() const;
@@ -73,6 +70,15 @@ namespace WebCore {
         virtual void dispatchErrorEvent();
 
     private:
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+    private:
         ScriptElementData m_data;
         String m_type;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
index 2867d00..a07b2a7 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.cpp
@@ -34,6 +34,7 @@ SVGSwitchElement::SVGSwitchElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
index a2be835..f5e9a0d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSwitchElement.h
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -22,8 +20,8 @@
 
 #ifndef SVGSwitchElement_h
 #define SVGSwitchElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
 #include "SVGStyledTransformableElement.h"
@@ -44,16 +42,14 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
-        mutable bool m_insideRenderSection;
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSwitchElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
index 073a13d..4155b0c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.cpp
@@ -34,6 +34,9 @@ SVGSymbolElement::SVGSymbolElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -47,7 +50,7 @@ void SVGSymbolElement::parseMappedAttribute(MappedAttribute* attr)
         return;
     if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
         return;
-    if (SVGFitToViewBox::parseMappedAttribute(attr))
+    if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
         return;
 
     SVGStyledElement::parseMappedAttribute(attr);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
index a6ccbce..5c68202 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSymbolElement.h
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -22,8 +20,8 @@
 
 #ifndef SVGSymbolElement_h
 #define SVGSymbolElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGExternalResourcesRequired.h"
 #include "SVGFitToViewBox.h"
 #include "SVGLangSpace.h"
@@ -44,8 +42,15 @@ namespace WebCore {
     
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+ 
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio) 
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
index 872e7c8..5b8640a 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
     , SVGURIReference()
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
index 88eeef1..71d40a0 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTRefElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -40,11 +38,11 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         void updateReferencedText();
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTRefElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
index 86009c1..9334304 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
@@ -52,6 +52,7 @@ SVGTextContentElement::SVGTextContentElement(const QualifiedName& tagName, Docum
     , SVGExternalResourcesRequired()
     , m_textLength(this, SVGNames::textLengthAttr, LengthModeOther)
     , m_lengthAdjust(this, SVGNames::lengthAdjustAttr, LENGTHADJUST_SPACING)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
index 9933b2c..9b2c938 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -66,12 +64,14 @@ namespace WebCore {
 
         bool isKnownAttribute(const QualifiedName&);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::textLengthAttrString, SVGLength, TextLength, textLength)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::lengthAdjustAttrString, int, LengthAdjust, lengthAdjust)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired) 
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
index 54a4aa2..ebbb628 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.cpp
@@ -41,6 +41,7 @@ SVGTextPathElement::SVGTextPathElement(const QualifiedName& tagName, Document* d
     , m_startOffset(this, SVGNames::startOffsetAttr, LengthModeOther)
     , m_method(this, SVGNames::methodAttr, SVG_TEXTPATH_METHODTYPE_ALIGN)
     , m_spacing(this, SVGNames::spacingAttr, SVG_TEXTPATH_SPACINGTYPE_EXACT)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
index 4e8899a..1bfcc8b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextPathElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -64,13 +62,13 @@ namespace WebCore {
 
         bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::startOffsetAttrString, SVGLength, StartOffset, startOffset)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::methodAttrString, int, Method, method)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::spacingAttrString, int, Spacing, spacing)
+    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
index 8871229..24febc3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.cpp
@@ -30,7 +30,6 @@ namespace WebCore {
 char SVGURIReferenceIdentifier[] = "SVGURIReference";
 
 SVGURIReference::SVGURIReference()
-    : m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
index 35ac640..812fb59 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGURIReference.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
     This file is part of the KDE project
@@ -42,10 +42,8 @@ namespace WebCore {
 
         static String getTarget(const String& url);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGURIReference, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+    protected:
+        virtual void setHrefBaseValue(SVGAnimatedTypeValue<String>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
index 0c2abe0..42517bd 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
@@ -65,6 +65,8 @@ SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -482,13 +484,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
         targetInstance->appendChild(instancePtr.get());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
-        if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr.get(), foundProblem);
-
-        // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
-        // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
-        if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr.get(), foundProblem);
+        buildInstanceTree(element, instancePtr.get(), foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
index 1e5b81c..45ca783 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -68,15 +66,20 @@ namespace WebCore {
         static void removeDisallowedElementsFromSubtree(Node* element);
         SVGElementInstance* instanceForShadowTreeElement(Node* element) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::yAttrString, SVGLength, Y, y)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
     private:
         // Instance tree handling
         void buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundCycle);
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
index 61cb397..af1d1fe 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.cpp
@@ -40,6 +40,9 @@ SVGViewElement::SVGViewElement(const QualifiedName& tagName, Document* doc)
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
     , SVGZoomAndPan()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -61,7 +64,7 @@ void SVGViewElement::parseMappedAttribute(MappedAttribute* attr)
         viewTarget()->reset(attr->value());
     else {
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr)
-           || SVGFitToViewBox::parseMappedAttribute(attr)
+           || SVGFitToViewBox::parseMappedAttribute(document(), attr)
            || SVGZoomAndPan::parseMappedAttribute(attr))
             return;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
index 840dea9..33d0ae3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -46,10 +44,16 @@ namespace WebCore {
 
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+ 
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         mutable RefPtr<SVGStringList> m_viewTarget;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
index b12b1c2..e6ded33 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,8 +34,10 @@ namespace WebCore {
 SVGViewSpec::SVGViewSpec(const SVGSVGElement* contextElement)
     : SVGFitToViewBox()
     , SVGZoomAndPan()
-    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
     , m_contextElement(contextElement)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
 {
 }
 
@@ -55,7 +55,7 @@ void SVGViewSpec::setViewBoxString(const String& viewBox)
     float x, y, w, h;
     const UChar* c = viewBox.characters();
     const UChar* end = c + viewBox.length();
-    if (!parseViewBox(c, end, x, y, w, h, false))
+    if (!parseViewBox(m_contextElement->document(), c, end, x, y, w, h, false))
         return;
     setViewBoxBaseValue(FloatRect(x, y, w, h));
 }
@@ -74,12 +74,7 @@ void SVGViewSpec::setViewTargetString(const String& viewTargetString)
 
 SVGElement* SVGViewSpec::viewTarget() const
 {
-    return static_cast<SVGElement*>(m_contextElement->ownerDocument()->getElementById(m_viewTargetString));
-}
-
-const SVGElement* SVGViewSpec::contextElement() const
-{
-    return m_contextElement;
+    return static_cast<SVGElement*>(m_contextElement->document()->getElementById(m_viewTargetString));
 }
 
 static const UChar svgViewSpec[] = {'s', 'v', 'g', 'V', 'i', 'e', 'w'};
@@ -111,7 +106,7 @@ bool SVGViewSpec::parseViewSpec(const String& viewSpec)
                     return false;
                 currViewSpec++;
                 float x, y, w, h;
-                if (!parseViewBox(currViewSpec, end, x, y, w, h, false))
+                if (!parseViewBox(m_contextElement->document(), currViewSpec, end, x, y, w, h, false))
                     return false;
                 setViewBoxBaseValue(FloatRect(x, y, w, h));
                 if (currViewSpec >= end || *currViewSpec != ')')
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
index 8624089..090b7ae 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGViewSpec.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -53,11 +51,16 @@ namespace WebCore {
         String viewTargetString() const { return m_viewTargetString; }
         SVGElement* viewTarget() const;
 
-        virtual const SVGElement* contextElement() const;
+        const SVGSVGElement* contextElement() const { return m_contextElement; }
 
     private:
-        mutable RefPtr<SVGTransformList> m_transform;
         const SVGSVGElement* m_contextElement;
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+
+        mutable RefPtr<SVGTransformList> m_transform;
         String m_viewTargetString;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
new file mode 100644
index 0000000..e969514
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.cpp
@@ -0,0 +1,163 @@
+/*
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SynchronizablePropertyController.h"
+
+#include "NamedNodeMap.h"
+#include "Node.h"
+#include "SVGAnimatedProperty.h"
+
+namespace WebCore {
+
+SynchronizablePropertyController::SynchronizablePropertyController()
+{
+}
+
+void SynchronizablePropertyController::registerProperty(const QualifiedName& attrName, SVGAnimatedPropertyBase* base)
+{
+    // 'attrName' is ambigious. For instance in SVGMarkerElement both 'orientType' / 'orientAngle'
+    // SVG DOM objects are synchronized with the 'orient' attribute. This why we need a HashSet.
+    SynchronizableProperty property(base);
+
+    PropertyMap::iterator it = m_map.find(attrName.localName());
+    if (it == m_map.end()) {
+        Properties properties;
+        properties.add(property);
+        m_map.set(attrName.localName(), properties);
+        return;
+    }
+
+    Properties& properties = it->second;
+    ASSERT(!properties.isEmpty());
+
+    properties.add(property);
+}
+
+void SynchronizablePropertyController::setPropertyNeedsSynchronization(const QualifiedName& attrName)
+{
+    PropertyMap::iterator itProp = m_map.find(attrName.localName());
+    ASSERT(itProp != m_map.end());
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+        property.shouldSynchronize = true;
+    }
+}
+
+void SynchronizablePropertyController::synchronizeProperty(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+
+        if (!property.shouldSynchronize)
+            continue;
+
+        property.base->synchronize();
+    }
+}
+
+void SynchronizablePropertyController::synchronizeAllProperties()
+{
+    if (m_map.isEmpty())
+        return;
+
+    PropertyMap::iterator itProp = m_map.begin();
+    PropertyMap::iterator endProp = m_map.end();
+
+    for (; itProp != endProp; ++itProp) {
+        Properties& properties = itProp->second;
+        ASSERT(!properties.isEmpty());
+
+        Properties::iterator it = properties.begin();
+        Properties::iterator end = properties.end();
+
+        for (; it != end; ++it) {
+            SynchronizableProperty& property = *it;
+            ASSERT(property.base);
+
+            if (!property.shouldSynchronize)
+                continue;
+
+            property.base->synchronize();
+        }
+    }
+}
+
+void SynchronizablePropertyController::startAnimation(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+        property.base->startAnimation();
+    }
+}
+
+void SynchronizablePropertyController::stopAnimation(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    Properties& properties = itProp->second;
+    ASSERT(!properties.isEmpty());
+
+    Properties::iterator it = properties.begin();
+    Properties::iterator end = properties.end();
+
+    for (; it != end; ++it) {
+        SynchronizableProperty& property = *it;
+        ASSERT(property.base);
+        property.base->stopAnimation();
+    }
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
new file mode 100644
index 0000000..b7f101b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/svg/SynchronizablePropertyController.h
@@ -0,0 +1,122 @@
+/*
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SynchronizablePropertyController_h
+#define SynchronizablePropertyController_h
+
+#if ENABLE(SVG)
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class QualifiedName;
+class SVGAnimatedPropertyBase;
+
+struct SynchronizableProperty {
+    SynchronizableProperty()
+        : base(0)
+        , shouldSynchronize(false)
+    {
+    }
+
+    explicit SynchronizableProperty(SVGAnimatedPropertyBase* _base)
+        : base(_base)
+        , shouldSynchronize(false)
+    {
+    }
+
+    explicit SynchronizableProperty(WTF::HashTableDeletedValueType)
+        : base(reinterpret_cast<SVGAnimatedPropertyBase*>(-1))
+        , shouldSynchronize(false)
+    {
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return base == reinterpret_cast<SVGAnimatedPropertyBase*>(-1);
+    }
+
+    bool operator==(const SynchronizableProperty& other) const
+    {
+        return base == other.base && shouldSynchronize == other.shouldSynchronize;
+    }
+
+    SVGAnimatedPropertyBase* base;
+    bool shouldSynchronize;
+};
+
+struct SynchronizablePropertyHash {
+    static unsigned hash(const SynchronizableProperty& key)
+    {
+        return StringImpl::computeHash(reinterpret_cast<const UChar*>(&key), sizeof(SynchronizableProperty) / sizeof(UChar));
+    }
+
+    static bool equal(const SynchronizableProperty& a, const SynchronizableProperty& b)
+    {
+        return a == b;
+    }
+
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+struct SynchronizablePropertyHashTraits : WTF::GenericHashTraits<SynchronizableProperty> {
+    static const bool emptyValueIsZero = true;
+
+    static void constructDeletedValue(SynchronizableProperty& slot)
+    {
+        new (&slot) SynchronizableProperty(WTF::HashTableDeletedValue);
+    }
+
+    static bool isDeletedValue(const SynchronizableProperty& value)
+    {
+        return value.isHashTableDeletedValue();
+    }
+};
+
+// Helper class used exclusively by SVGElement to keep track of all animatable properties within a SVGElement,
+// and wheter they are supposed to be synchronized or not (depending wheter AnimatedPropertyTearOff's have been created)
+class SynchronizablePropertyController : public Noncopyable {
+public:
+    void registerProperty(const QualifiedName&, SVGAnimatedPropertyBase*);
+    void setPropertyNeedsSynchronization(const QualifiedName&);
+
+    void synchronizeProperty(const String&);
+    void synchronizeAllProperties();
+
+    void startAnimation(const String&);
+    void stopAnimation(const String&);
+
+private:
+    friend class SVGElement;
+    SynchronizablePropertyController();
+
+private:
+    typedef HashSet<SynchronizableProperty, SynchronizablePropertyHash, SynchronizablePropertyHashTraits> Properties;
+    typedef HashMap<String, Properties> PropertyMap;
+
+    PropertyMap m_map;
+};
+
+};
+
+#endif // ENABLE(SVG)
+#endif // SynchronizablePropertyController_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index bb68b82..0a506f8 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -239,14 +239,13 @@ bool SVGImage::dataChanged(bool allDataReceived)
         static DragClient* dummyDragClient = 0;
 #endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
-        static PluginHalterClient* dummyPluginHalterClient = new EmptyPluginHalterClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
         // FIXME: If this SVG ends up loading itself, we might leak the world.
-        // THe comment said that the Cache code does not know about CachedImages
+        // The comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, dummyPluginHalterClient));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
@@ -256,7 +255,7 @@ bool SVGImage::dataChanged(bool allDataReceived)
         ResourceRequest fakeRequest(KURL(ParsedURLString, ""));
         FrameLoader* loader = frame->loader();
         loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
-        loader->cancelContentPolicyCheck(); // cancel any policy checks
+        loader->policyChecker()->cancelCheck(); // cancel any policy checks
         loader->commitProvisionalLoad(0);
         loader->setResponseMIMEType("image/svg+xml");
         loader->begin(KURL()); // create the empty document
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
index 4a4bdd5..973743c 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -31,52 +31,44 @@
 #include "PlatformString.h"
 #include "SVGFilter.h"
 #include "SVGFilterBuilder.h"
+#include "SVGFilterElement.h"
 #include "SVGRenderTreeAsText.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
 
-SVGResourceFilter::SVGResourceFilter()
-    : m_filterBBoxMode(false)
+SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
+    : SVGResource()
+    , m_ownerElement(ownerElement)
+    , m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
-    , m_xBBoxMode(false)
-    , m_yBBoxMode(false)
     , m_savedContext(0)
     , m_sourceGraphicBuffer(0)
 {
     m_filterBuilder.set(new SVGFilterBuilder());
 }
 
-void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
+SVGResourceFilter::~SVGResourceFilter()
 {
-    effectAttributes->setStandardAttributes(this, effect.get());
-    builder()->add(effectAttributes->result(), effect);
 }
 
-FloatRect SVGResourceFilter::filterBBoxForItemBBox(const FloatRect& itemBBox) const
+void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
-    FloatRect filterBBox = filterRect();
-
-    if (filterBoundingBoxMode())
-        filterBBox = FloatRect(itemBBox.x() + filterBBox.x() * itemBBox.width(),
-                               itemBBox.y() + filterBBox.y() * itemBBox.height(),
-                               filterBBox.width() * itemBBox.width(),
-                               filterBBox.height() * itemBBox.height());
-
-    return filterBBox;
+    effectAttributes->setStandardAttributes(this, effect.get());
+    builder()->add(effectAttributes->result(), effect);
 }
 
 void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
 {
-    m_itemBBox = object->objectBoundingBox();
-    m_filterBBox = filterBBoxForItemBBox(m_itemBBox);
+    FloatRect targetRect = object->objectBoundingBox();
+    m_ownerElement->buildFilter(targetRect);
 
     // clip sourceImage to filterRegion
-    FloatRect clippedSourceRect = m_itemBBox;
+    FloatRect clippedSourceRect = targetRect;
     clippedSourceRect.intersect(m_filterBBox);
 
     // prepare Filters
-    m_filter = SVGFilter::create(m_itemBBox, m_filterBBox, m_effectBBoxMode, m_filterBBoxMode);
+    m_filter = SVGFilter::create(targetRect, m_filterBBox, m_effectBBoxMode);
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
     if (lastEffect)
@@ -91,8 +83,8 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
         return;
 
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
-    sourceGraphicContext->translate(-m_itemBBox.x(), -m_itemBBox.y());
-    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), m_itemBBox.size()));
+    sourceGraphicContext->translate(-targetRect.x(), -targetRect.y());
+    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), targetRect.size()));
     m_sourceGraphicBuffer.set(sourceGraphic.release());
     m_savedContext = context;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
index ee1efca..86b11fe 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.h
@@ -43,11 +43,13 @@ class Filter;
 class FilterEffect;
 class GraphicsContext;
 class SVGFilterBuilder;
+class SVGFilterElement;
 class SVGFilterPrimitiveStandardAttributes;
 
 class SVGResourceFilter : public SVGResource {
 public:
-    SVGResourceFilter();
+    static PassRefPtr<SVGResourceFilter> create(const SVGFilterElement* ownerElement) { return adoptRef(new SVGResourceFilter(ownerElement)); }
+    virtual ~SVGResourceFilter();
     
     virtual SVGResourceType resourceType() const { return FilterResourceType; }
 
@@ -57,44 +59,31 @@ public:
     bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
     void setEffectBoundingBoxMode(bool bboxMode) { m_effectBBoxMode = bboxMode; }
 
-    bool xBoundingBoxMode() const { return m_xBBoxMode; }
-    void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-    bool yBoundingBoxMode() const { return m_yBBoxMode; }
-    void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
     FloatRect filterBoundingBox() { return m_filterBBox; }
     void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
-    FloatRect itemBoundingBox() { return m_itemBBox; }
-    void setItemBoundingBox(const FloatRect& rect) { m_itemBBox = rect; }
-
-    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
-
-    virtual TextStream& externalRepresentation(TextStream&) const;
-
     void prepareFilter(GraphicsContext*&, const RenderObject*);
     void applyFilter(GraphicsContext*&, const RenderObject*);
 
     void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
 
     SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
+
+    virtual TextStream& externalRepresentation(TextStream&) const;
     
 private:
+    SVGResourceFilter(const SVGFilterElement*);
+
+    const SVGFilterElement* m_ownerElement;
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
 
-    bool m_xBBoxMode : 1;
-    bool m_yBBoxMode : 1;
-
     FloatRect m_filterRect;
-
     FloatRect m_filterBBox;
-    FloatRect m_itemBBox;
 
     OwnPtr<SVGFilterBuilder> m_filterBuilder;
     GraphicsContext* m_savedContext;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 3f4a6d7..668209f 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -31,17 +31,16 @@
 
 namespace WebCore {
 
-FEFlood::FEFlood(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
+FEFlood::FEFlood(const Color& floodColor, const float& floodOpacity)
     : FilterEffect()
-    , m_in(in)
     , m_floodColor(floodColor)
     , m_floodOpacity(floodOpacity)
 {
 }
 
-PassRefPtr<FEFlood> FEFlood::create(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
+PassRefPtr<FEFlood> FEFlood::create(const Color& floodColor, const float& floodOpacity)
 {
-    return adoptRef(new FEFlood(in, floodColor, floodOpacity));
+    return adoptRef(new FEFlood(floodColor, floodOpacity));
 }
 
 Color FEFlood::floodColor() const
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
index 21985db..91795dd 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEFlood.h
@@ -31,7 +31,7 @@ namespace WebCore {
 
     class FEFlood : public FilterEffect {
     public:
-        static PassRefPtr<FEFlood> create(FilterEffect*, const Color&, const float&);
+        static PassRefPtr<FEFlood> create(const Color&, const float&);
 
         Color floodColor() const;
         void setFloodColor(const Color &);
@@ -44,9 +44,8 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEFlood(FilterEffect*, const Color&, const float&);
+        FEFlood(const Color&, const float&);
 
-        RefPtr<FilterEffect> m_in;
         Color m_floodColor;
         float m_floodOpacity;
     };
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
deleted file mode 100644
index 601c39e..0000000
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(FILTERS)
-#include "SVGFEGaussianBlur.h"
-#include "SVGRenderTreeAsText.h"
-#include "Filter.h"
-
-namespace WebCore {
-
-FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
-    : FilterEffect()
-    , m_in(in)
-    , m_x(x)
-    , m_y(y)
-{
-}
-
-PassRefPtr<FEGaussianBlur> FEGaussianBlur::create(FilterEffect* in, const float& x, const float& y)
-{
-    return adoptRef(new FEGaussianBlur(in, x, y));
-}
-
-float FEGaussianBlur::stdDeviationX() const
-{
-    return m_x;
-}
-
-void FEGaussianBlur::setStdDeviationX(float x)
-{
-    m_x = x;
-}
-
-float FEGaussianBlur::stdDeviationY() const
-{
-    return m_y;
-}
-
-void FEGaussianBlur::setStdDeviationY(float y)
-{
-    m_y = y;
-}
-
-void FEGaussianBlur::apply(Filter*)
-{
-}
-
-void FEGaussianBlur::dump()
-{
-}
-
-TextStream& FEGaussianBlur::externalRepresentation(TextStream& ts) const
-{
-    ts << "[type=GAUSSIAN-BLUR] ";
-    FilterEffect::externalRepresentation(ts);
-    ts << " [std dev. x=" << stdDeviationX() << " y=" << stdDeviationY() << "]";
-    return ts;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index 3767734..f7fc5d8 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -28,7 +28,7 @@
 
 namespace WebCore {
 
-FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, const float& radiusX, const float& radiusY)
+FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, float radiusX, float radiusY)
     : FilterEffect()
     , m_in(in)
     , m_type(type)
@@ -37,7 +37,7 @@ FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, const
 {
 }
 
-PassRefPtr<FEMorphology> FEMorphology::create(FilterEffect* in, MorphologyOperatorType type, const float& radiusX, const float& radiusY)
+PassRefPtr<FEMorphology> FEMorphology::create(FilterEffect* in, MorphologyOperatorType type, float radiusX, float radiusY)
 {
     return adoptRef(new FEMorphology(in, type, radiusX, radiusY));
 }
@@ -88,8 +88,8 @@ static TextStream& operator<<(TextStream& ts, MorphologyOperatorType t)
             ts << "UNKNOWN"; break;
         case FEMORPHOLOGY_OPERATOR_ERODE:
             ts << "ERODE"; break;
-        case FEMORPHOLOGY_OPERATOR_DIALATE:
-            ts << "DIALATE"; break;
+        case FEMORPHOLOGY_OPERATOR_DILATE:
+            ts << "DILATE"; break;
     }
     return ts;
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
index bdc2b9b..6a321c8 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFEMorphology.h
@@ -31,12 +31,12 @@ namespace WebCore {
     enum MorphologyOperatorType {
         FEMORPHOLOGY_OPERATOR_UNKNOWN = 0,
         FEMORPHOLOGY_OPERATOR_ERODE   = 1,
-        FEMORPHOLOGY_OPERATOR_DIALATE = 2
+        FEMORPHOLOGY_OPERATOR_DILATE  = 2
     };
 
     class FEMorphology : public FilterEffect {
     public:
-        PassRefPtr<FEMorphology> create(FilterEffect*, MorphologyOperatorType, const float&, const float&);  
+        static PassRefPtr<FEMorphology> create(FilterEffect*, MorphologyOperatorType, float radiusX, float radiusY);  
         MorphologyOperatorType morphologyOperator() const;
         void setMorphologyOperator(MorphologyOperatorType);
 
@@ -52,7 +52,7 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEMorphology(FilterEffect*, MorphologyOperatorType, const float&, const float&);
+        FEMorphology(FilterEffect*, MorphologyOperatorType, float radiusX, float radiusY);
         
         RefPtr<FilterEffect> m_in;
         MorphologyOperatorType m_type;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
index c892ee9..6bfcf39 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -24,12 +24,11 @@
 
 namespace WebCore {
 
-SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
     : Filter()
     , m_itemBox(itemBox)
     , m_filterRect(filterRect)
     , m_effectBBoxMode(effectBBoxMode)
-    , m_filterBBoxMode(filterBBoxMode)
 {
 }
 
@@ -37,7 +36,6 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
 {
     FloatRect subRegionBBox = effect->subRegion();
     FloatRect useBBox = effect->unionOfChildEffectSubregions();
-
     FloatRect newSubRegion = subRegionBBox;
 
     if (m_effectBBoxMode) {
@@ -55,17 +53,17 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
         if (effect->hasHeight())
             newSubRegion.setHeight(subRegionBBox.height() * m_itemBox.height());
     } else {
-        if (effect->xBoundingBoxMode())
-            newSubRegion.setX(useBBox.x() + subRegionBBox.x() * useBBox.width());
+        if (!effect->hasX())
+            newSubRegion.setX(useBBox.x());
 
-        if (effect->yBoundingBoxMode())
-            newSubRegion.setY(useBBox.y() + subRegionBBox.y() * useBBox.height());
+        if (!effect->hasY())
+            newSubRegion.setY(useBBox.y());
 
-        if (effect->widthBoundingBoxMode())
-            newSubRegion.setWidth(subRegionBBox.width() * useBBox.width());
+        if (!effect->hasWidth())
+            newSubRegion.setWidth(useBBox.width());
 
-        if (effect->heightBoundingBoxMode())
-            newSubRegion.setHeight(subRegionBBox.height() * useBBox.height());
+        if (!effect->hasHeight())
+            newSubRegion.setHeight(useBBox.height());
     }
 
     // clip every filter effect to the filter region
@@ -74,9 +72,9 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
     effect->setSubRegion(newSubRegion);
 }
 
-PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
 {
-    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode, filterBBoxMode));
+    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
index d6e5f77..f23d1ea 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFilter.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
     class SVGFilter : public Filter {
     public:
-        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool, bool);
+        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
 
         bool effectBoundingBoxMode() { return m_effectBBoxMode; }
 
@@ -42,12 +42,11 @@ namespace WebCore {
         void calculateEffectSubRegion(FilterEffect*);
 
     private:
-        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool itemBBoxMode, bool filterBBoxMode);
+        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode);
 
         FloatRect m_itemBox;
         FloatRect m_filterRect;
         bool m_effectBBoxMode;
-        bool m_filterBBoxMode;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/svg/svgtags.in b/src/3rdparty/webkit/WebCore/svg/svgtags.in
index 471c77b..30a0e4c 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgtags.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgtags.in
@@ -47,9 +47,7 @@ feGaussianBlur createWithNew
 feImage createWithNew
 feMerge createWithNew
 feMergeNode createWithNew
-#if 0
 feMorphology createWithNew
-#endif
 feOffset createWithNew
 fePointLight createWithNew
 feSpecularLighting createWithNew
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
index dd89c14..f3bbdd7 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
@@ -86,6 +86,22 @@ static bool isValidProtocolString(const WebCore::String& protocol)
     return true;
 }
 
+#if USE(V8)
+
+static bool webSocketsAvailable = false;
+
+void WebSocket::setIsAvailable(bool available)
+{
+    webSocketsAvailable = available;
+}
+
+bool WebSocket::isAvailable()
+{
+    return webSocketsAvailable;
+}
+
+#endif
+
 WebSocket::WebSocket(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
@@ -189,7 +205,7 @@ void WebSocket::didReceiveMessage(const String& msg)
         return;
     RefPtr<MessageEvent> evt = MessageEvent::create();
     // FIXME: origin, lastEventId, source, messagePort.
-    evt->initMessageEvent(eventNames().messageEvent, false, false, msg, "", "", 0, 0);
+    evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
     scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
index c5b7ee7..9ecbed7 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
@@ -50,6 +50,10 @@ namespace WebCore {
 
     class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
     public:
+#if USE(V8)
+        static void setIsAvailable(bool);
+        static bool isAvailable();
+#endif
         static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
         virtual ~WebSocket();
 
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
index 04606fe..c662940 100644
--- a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
@@ -55,13 +55,13 @@ module websockets {
         void close();
 
         // EventTarget interface
-        // [Custom] void addEventListener(in DOMString type,
-        //   in EventListener listener,
-        //   in boolean useCapture);
-        // [Custom] void removeEventListener(in DOMString type,
-        //   in EventListener listener,
-        //   in boolean useCapture);
-        // boolean dispatchEvent(in Event evt)
-        //   raises(EventException);
+        [Custom] void addEventListener(in DOMString type,
+                                       in EventListener listener,
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
index d47868a..e577218 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLImageElement.cpp
@@ -94,13 +94,12 @@ void WMLImageElement::attach()
 {
     WMLElement::attach();
 
-    if (renderer() && renderer()->isImage()) {
+    if (renderer() && renderer()->isImage() && m_imageLoader.haveFiredBeforeLoadEvent()) {
         RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
-
         imageObj->setCachedImage(m_imageLoader.image());
-
+        
         // If we have no image at all because we have no src attribute, set
         // image height and width for the alt text instead.
         if (!m_imageLoader.image() && !imageObj->cachedImage())
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
index 5206fd9..82dc4b3 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
@@ -47,7 +47,7 @@ DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& us
 }
 
 // FIXME: remove this when we update the ObjC bindings (bug #28774).
-void DedicatedWorkerContext::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -55,12 +55,12 @@ void DedicatedWorkerContext::postMessage(const String& message, MessagePort* por
     postMessage(message, &ports, ec);
 }
 
-void DedicatedWorkerContext::postMessage(const String& message, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
     postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void DedicatedWorkerContext::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (isClosing())
         return;
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
index 7609fcd..74a39d9 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
@@ -55,10 +55,10 @@ namespace WebCore {
 
         // EventTarget
         virtual DedicatedWorkerContext* toDedicatedWorkerContext() { return this; }
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, const MessagePortArray*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, MessagePort*, ExceptionCode&);
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
 
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
index 899bbae..f421b9a 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
@@ -39,7 +39,7 @@ module threads {
     ] DedicatedWorkerContext : WorkerContext {
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
+        [Custom] void postMessage(in any message, in [Optional] Array messagePorts)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
diff --git a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 11106ee..8b1a480 100644
--- a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -63,8 +63,13 @@ public:
     void setThread(PassRefPtr<SharedWorkerThread> thread) { m_thread = thread; }
     SharedWorkerThread* thread() { return m_thread.get(); }
     bool isClosing() const { return m_closing; }
-    KURL url() const { return m_url.copy(); }
-    String name() const { return m_name.copy(); }
+    KURL url() const
+    {
+        // Don't use m_url.copy() because it isn't a threadsafe method.
+        return KURL(ParsedURLString, m_url.string().threadsafeCopy());
+    }
+
+    String name() const { return m_name.threadsafeCopy(); }
     bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
@@ -102,7 +107,7 @@ private:
 
 SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin)
     : m_closing(false)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_url(url.copy())
     , m_origin(origin)
 {
@@ -311,6 +316,12 @@ void DefaultSharedWorkerRepository::workerScriptLoaded(SharedWorkerProxy& proxy,
     proxy.thread()->runLoop().postTask(SharedWorkerConnectTask::create(port));
 }
 
+bool SharedWorkerRepository::isAvailable()
+{
+    // SharedWorkers are enabled on the default WebKit platform.
+    return true;
+}
+
 void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
 {
     DefaultSharedWorkerRepository::instance().connectToWorker(worker, port, url, name, ec);
@@ -379,8 +390,9 @@ void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> wor
 PassRefPtr<SharedWorkerProxy> DefaultSharedWorkerRepository::getProxy(const String& name, const KURL& url)
 {
     // Look for an existing worker, and create one if it doesn't exist.
-    // Items in the cache are freed on another thread, so copy the URL before creating the origin, to make sure no references to external strings linger.
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url.copy());
+    // Items in the cache are freed on another thread, so do a threadsafe copy of the URL before creating the origin,
+    // to make sure no references to external strings linger.
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(KURL(ParsedURLString, url.string().threadsafeCopy()));
     for (unsigned i = 0; i < m_proxies.size(); i++) {
         if (!m_proxies[i]->isClosing() && m_proxies[i]->matches(name, origin, url))
             return m_proxies[i];
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h b/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
index 96d2fb1..49f3941 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
@@ -48,6 +48,9 @@ namespace WebCore {
     // Interface to a repository which manages references to the set of active shared workers.
     class SharedWorkerRepository {
     public:
+        // Returns true if the platform supports SharedWorkers, otherwise false.
+        static bool isAvailable();
+
         // Connects the passed SharedWorker object with the specified worker thread, creating a new thread if necessary.
         static void connect(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
 
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
index ded4834..e59df4f 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
@@ -45,7 +45,7 @@ PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, co
 
 SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
     : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.cpp b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
index c2c25c1..864b7c6 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
@@ -70,7 +70,7 @@ Worker::~Worker()
 }
 
 // FIXME: remove this when we update the ObjC bindings (bug #28774).
-void Worker::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
     MessagePortArray ports;
     if (port)
@@ -78,12 +78,12 @@ void Worker::postMessage(const String& message, MessagePort* port, ExceptionCode
     postMessage(message, &ports, ec);
 }
 
-void Worker::postMessage(const String& message, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
     postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void Worker::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     // Disentangle the port in preparation for sending it to the remote context.
     OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.h b/src/3rdparty/webkit/WebCore/workers/Worker.h
index 41d39a2..6b8fa84 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.h
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.h
@@ -58,10 +58,10 @@ namespace WebCore {
 
         virtual Worker* toWorker() { return this; }
 
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, const MessagePortArray*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
-        void postMessage(const String& message, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
 
         void terminate();
 
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.idl b/src/3rdparty/webkit/WebCore/workers/Worker.idl
index 9c9342b..0382739 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.idl
@@ -35,11 +35,11 @@ module threads {
         attribute EventListener onmessage;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
+        [Custom] void postMessage(in SerialisedScriptValue message, in [Optional] Array messagePorts)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+        void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort)
             raises(DOMException);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
index d55452e..e1ca139 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
@@ -53,7 +53,7 @@ namespace WebCore {
 
         virtual void terminateWorkerContext() = 0;
 
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannelArray>) = 0;
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual bool hasPendingActivity() const = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
index 3d28f9e..0b66694 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
@@ -46,14 +46,14 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
         return adoptRef(new MessageWorkerContextTask(message, channels));
     }
 
 private:
-    MessageWorkerContextTask(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
-        : m_message(message.copy())
+    MessageWorkerContextTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+        : m_message(message->release())
         , m_channels(channels)
     {
     }
@@ -68,20 +68,20 @@ private:
     }
 
 private:
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     OwnPtr<MessagePortChannelArray> m_channels;
 };
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(const String& message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
         return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
     }
 
 private:
-    MessageWorkerTask(const String& message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
-        : m_message(message.copy())
+    MessageWorkerTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+        : m_message(message->release())
         , m_channels(channels)
         , m_messagingProxy(messagingProxy)
     {
@@ -98,7 +98,7 @@ private:
     }
 
 private:
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     OwnPtr<MessagePortChannelArray> m_channels;
     WorkerMessagingProxy* m_messagingProxy;
 };
@@ -112,9 +112,9 @@ public:
 
 private:
     WorkerExceptionTask(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
-        : m_errorMessage(errorMessage.copy())
+        : m_errorMessage(errorMessage.crossThreadString())
         , m_lineNumber(lineNumber)
-        , m_sourceURL(sourceURL.copy())
+        , m_sourceURL(sourceURL.crossThreadString())
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -240,12 +240,12 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
     thread->start();
 }
 
-void WorkerMessagingProxy::postMessageToWorkerObject(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+void WorkerMessagingProxy::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channels.release(), this));
 }
 
-void WorkerMessagingProxy::postMessageToWorkerContext(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
+void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     if (m_askedToTerminate)
         return;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
index 8ab0cb6..754102a 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
@@ -54,13 +54,13 @@ namespace WebCore {
         // (Only use these methods in the worker object thread.)
         virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode);
         virtual void terminateWorkerContext();
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannelArray>);
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual bool hasPendingActivity() const;
         virtual void workerObjectDestroyed();
 
         // Implementations of WorkerObjectProxy.
         // (Only use these methods in the worker context thread.)
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannelArray>);
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
         virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity);
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
index 77a7d7d..33e0bc3 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
@@ -44,7 +44,7 @@ namespace WebCore {
     // A proxy to talk to the worker object.
     class WorkerObjectProxy : public WorkerReportingProxy {
     public:
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannelArray>) = 0;
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
         virtual void reportPendingActivity(bool hasPendingActivity) = 0;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
index 449dd78..6a58d52 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
@@ -77,7 +77,7 @@ public:
 private:
     Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
         : m_task(task)
-        , m_mode(mode.copy())
+        , m_mode(mode.crossThreadString())
     {
     }
 
@@ -205,7 +205,7 @@ void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
 
 void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
-    m_messageQueue.append(Task::create(task, mode.copy()));
+    m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
index 22253bf..467157b 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
@@ -71,8 +71,8 @@ private:
 
 WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
     : m_scriptURL(scriptURL.copy())
-    , m_userAgent(userAgent.copy())
-    , m_sourceCode(sourceCode.copy())
+    , m_userAgent(userAgent.crossThreadString())
+    , m_sourceCode(sourceCode.crossThreadString())
 {
 }
 
diff --git a/src/3rdparty/webkit/WebKit.pri b/src/3rdparty/webkit/WebKit.pri
index fd918c9..2dba0d4 100644
--- a/src/3rdparty/webkit/WebKit.pri
+++ b/src/3rdparty/webkit/WebKit.pri
@@ -31,7 +31,10 @@ building-libs {
     DEPENDPATH += $$PWD/WebKit/qt/Api
 }
 
-DEFINES += USE_SYSTEM_MALLOC
+!mac:!unix|symbian {
+    DEFINES += USE_SYSTEM_MALLOC
+}
+
 CONFIG(release, debug|release) {
     DEFINES += NDEBUG
 }
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index 2f8f18f..607a039 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,136 @@
+2009-10-19  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        set ENABLE_NOTIFICATIONS=1 for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=29949
+
+        * chromium/features.gypi:
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        * chromium/features.gypi:
+        Turned on ENABLE_SHARED_WORKERS by default. This doesn't actually turn on
+        SharedWorkers yet, as Chromium overrides this flag in its feature_overrides.gypi.
+
+2009-10-12  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Port - Windows
+        https://bugs.webkit.org/show_bug.cgi?id=29969
+
+        * chromium/DEPS: Added gtest dep required by windows and incremented some of the deps revisions.
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * English.lproj/Localizable.strings:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * WebKit.xcodeproj/project.pbxproj: Add WebPluginHalterClient to the project.
+
+2009-10-05  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        One of the dependencies' SVN url was missing a @ before the revision number.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30101
+
+        * chromium/DEPS:
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add new files for video fullscreen.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add testing harness for Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30010
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * chromium/features.gypi:
+
+2009-10-02  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added gyp_webkit that does a subset of the things gyp_chromium does
+        plus some specialization for an upstream chromium build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29986
+
+        * chromium/DEPS: Points to gyp_webkit instead of gyp_chromium.
+        * chromium/gyp_webkit: A new python file.
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make it possible to override the list of feature defines when building
+        downstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29979
+
+        * chromium/features.gypi:
+
+2009-10-01  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added windows-specific dependencies, updated some revisions and
+        re-organized file to make revision tracking easier. Also removed
+        extensions/v8 dependency that is no longer needed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29973
+
+        * chromium/DEPS:
+
+2009-09-30  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Keeping up with downstream revisions.
+        2. Turning off v8 snapshot build step.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29928
+
+        * chromium/DEPS
+
 2009-09-29  Brady Eidson  <beidson@apple.com>
 
         Reviewed by John Sullivan.
diff --git a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
index 3229ab5..6572d2c 100644
--- a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
+++ b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 1;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index b11890d..7e485a0 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -49,11 +50,16 @@ public:
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
 #endif
 
+#ifndef QT_NO_CURSOR
     virtual QCursor cursor() const;
     virtual void updateCursor(const QCursor& cursor);
+#endif
 
+    virtual QPalette palette() const;
     virtual int screenNumber() const;
-    virtual WId winId() const;
+    virtual QWidget* ownerWidget() const;
+
+    virtual QObject* pluginParent() const;
 
     void _q_doLoadProgress(int progress);
     void _q_doLoadFinished(bool success);
@@ -83,10 +89,7 @@ void QGraphicsWebViewPrivate::_q_doLoadFinished(bool success)
     if (q->title().isEmpty())
         emit q->urlChanged(q->url());
 
-    if (success)
-        emit q->loadFinished();
-    else
-        emit q->loadFailed();
+    emit q->loadFinished(success);
 }
 
 void QGraphicsWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
@@ -99,11 +102,11 @@ void QGraphicsWebViewPrivate::update(const QRect & dirtyRect)
     q->update(QRectF(dirtyRect));
 }
 
+
 void QGraphicsWebViewPrivate::setInputMethodEnabled(bool enable)
 {
     q->setAttribute(Qt::WA_InputMethodEnabled, enable);
 }
-
 #if QT_VERSION >= 0x040600
 void QGraphicsWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
 {
@@ -113,7 +116,7 @@ void QGraphicsWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool
         q->setInputMethodHints(q->inputMethodHints() & ~hint);
 }
 #endif
-
+#ifndef QT_NO_CURSOR
 QCursor QGraphicsWebViewPrivate::cursor() const
 {
     return q->cursor();
@@ -123,6 +126,12 @@ void QGraphicsWebViewPrivate::updateCursor(const QCursor& cursor)
 {
     q->setCursor(cursor);
 }
+#endif
+
+QPalette QGraphicsWebViewPrivate::palette() const
+{
+    return q->palette();
+}
 
 int QGraphicsWebViewPrivate::screenNumber() const
 {
@@ -136,14 +145,15 @@ int QGraphicsWebViewPrivate::screenNumber() const
     return 0;
 }
 
-WId QGraphicsWebViewPrivate::winId() const
+QWidget* QGraphicsWebViewPrivate::ownerWidget() const
 {
     const QList<QGraphicsView*> views = q->scene()->views();
+    return views.value(0);
+}
 
-    if (!views.isEmpty())
-        return views.at(0)->winId();
-
-    return 0;
+QObject* QGraphicsWebViewPrivate::pluginParent() const
+{
+    return q;
 }
 
 void QGraphicsWebViewPrivate::_q_setStatusBarMessage(const QString& s)
@@ -185,8 +195,10 @@ QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
 */
 QGraphicsWebView::~QGraphicsWebView()
 {
-    if (d->page)
+    if (d->page) {
         d->page->d->view = 0;
+        d->page->d->client = 0; // unset the page client
+    }
 
     if (d->page && d->page->parent() == this)
         delete d->page;
@@ -239,21 +251,38 @@ bool QGraphicsWebView::event(QEvent* event)
     // Re-implemented in order to allows fixing event-related bugs in patch releases.
 
     if (d->page) {
+#ifndef QT_NO_CONTEXTMENU
+        if (event->type() == QEvent::GraphicsSceneContextMenu) {
+            if (!isEnabled())
+                return false;
+
+            QGraphicsSceneContextMenuEvent* ev = static_cast<QGraphicsSceneContextMenuEvent*>(event);
+            QContextMenuEvent fakeEvent(QContextMenuEvent::Reason(ev->reason()), ev->pos().toPoint());
+            if (d->page->swallowContextMenuEvent(&fakeEvent)) {
+                event->accept();
+                return true;
+            }
+            d->page->updatePositionDependentActions(fakeEvent.pos());
+        } else
+#endif // QT_NO_CONTEXTMENU
+        {
 #ifndef QT_NO_CURSOR
 #if QT_VERSION >= 0x040400
-        } else if (event->type() == QEvent::CursorChange) {
-            // An unsetCursor will set the cursor to Qt::ArrowCursor.
-            // Thus this cursor change might be a QWidget::unsetCursor()
-            // If this is not the case and it came from WebCore, the
-            // QWebPageClient already has set its cursor internally
-            // to Qt::ArrowCursor, so updating the cursor is always
-            // right, as it falls back to the last cursor set by
-            // WebCore.
-            // FIXME: Add a QEvent::CursorUnset or similar to Qt.
-            if (cursor().shape() == Qt::ArrowCursor)
-                d->resetCursor();
+            if (event->type() == QEvent::CursorChange) {
+                // An unsetCursor will set the cursor to Qt::ArrowCursor.
+                // Thus this cursor change might be a QWidget::unsetCursor()
+                // If this is not the case and it came from WebCore, the
+                // QWebPageClient already has set its cursor internally
+                // to Qt::ArrowCursor, so updating the cursor is always
+                // right, as it falls back to the last cursor set by
+                // WebCore.
+                // FIXME: Add a QEvent::CursorUnset or similar to Qt.
+                if (cursor().shape() == Qt::ArrowCursor)
+                    d->resetCursor();
+            }
 #endif
 #endif
+        }
     }
     return QGraphicsWidget::event(event);
 }
@@ -608,7 +637,6 @@ void QGraphicsWebView::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
         QMouseEvent me = QMouseEvent(QEvent::MouseMove,
                 ev->pos().toPoint(), Qt::NoButton,
                 Qt::NoButton, Qt::NoModifier);
-        d->page->setView(ev->widget());
         d->page->event(&me);
         ev->setAccepted(accepted);
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
index a8478d8..26f7374 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
@@ -95,8 +95,7 @@ public Q_SLOTS:
 
 Q_SIGNALS:
     void loadStarted();
-    void loadFinished();
-    void loadFailed();
+    void loadFinished(bool);
 
     void progressChanged(qreal);
     void interactivityChanged();
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
index 939d881..5b83870 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -30,12 +30,14 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "FrameView.h"
+#include "GraphicsContext.h"
 #include "HTMLElement.h"
 #include "JSGlobalObject.h"
 #include "JSHTMLElement.h"
 #include "JSObject.h"
 #include "NodeList.h"
 #include "PropertyNameArray.h"
+#include "RenderImage.h"
 #include "ScriptFunctionCall.h"
 #include "StaticNodeList.h"
 #include "qt_runtime.h"
@@ -45,6 +47,8 @@
 #include <parser/SourceCode.h>
 #include <wtf/Vector.h>
 
+#include <QPainter>
+
 using namespace WebCore;
 
 class QWebElementPrivate {
@@ -1411,3 +1415,38 @@ QWebElement QWebElement::enclosingElement(WebCore::Node* node)
     Returns true if this element points to a different underlying DOM object
     than \a o; otherwise returns false.
 */
+
+
+/*! 
+  Render the element into \a painter .
+*/
+void QWebElement::render(QPainter* painter)
+{
+    WebCore::Element* e = m_element;
+    Document* doc = e ? e->document() : 0;
+    if (!doc)
+        return;
+
+    Frame* frame = doc->frame();
+    if (!frame || !frame->view() || !frame->contentRenderer())
+        return;
+
+    FrameView* view = frame->view();
+
+    view->layoutIfNeededRecursive();
+
+    IntRect rect = e->getRect();
+
+    if (rect.size().isEmpty())
+        return;
+
+    GraphicsContext context(painter);
+
+    context.save();
+    context.translate(-rect.x(), -rect.y());
+    view->setNodeToDraw(e);
+    view->paintContents(&context, rect);
+    view->setNodeToDraw(0);
+    context.restore();
+}
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
index 3db4637..351ccb4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -31,6 +31,10 @@ namespace WebCore {
     class Node;
 }
 
+QT_BEGIN_NAMESPACE
+class QPainter;
+QT_END_NAMESPACE
+
 class QWebFrame;
 class QWebElementPrivate;
 
@@ -133,6 +137,8 @@ public:
     QString styleProperty(const QString& name, StyleResolveStrategy strategy) const;
     void setStyleProperty(const QString& name, const QString& value);
 
+    void render(QPainter* painter);
+
 private:
     explicit QWebElement(WebCore::Element*);
     explicit QWebElement(WebCore::Node*);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index 780f862..d2c324d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -540,15 +540,26 @@ QUrl QWebFrame::url() const
 */
 QUrl QWebFrame::requestedUrl() const
 {
-    // In the following edge cases (where the failing document
-    // loader does not get commited by the frame loader) it is
-    // safer to rely on outgoingReferrer than originalRequest.
-    if (!d->frame->loader()->activeDocumentLoader()
-        || (!d->frameLoaderClient->m_loadError.isNull()
-        &&  !d->frame->loader()->outgoingReferrer().isEmpty()))
-        return QUrl(d->frame->loader()->outgoingReferrer());
+    // There are some possible edge cases to be handled here,
+    // apart from checking if activeDocumentLoader is valid:
+    //
+    // * Method can be called while processing an unsucessful load.
+    //   In this case, frameLoaderClient will hold the current error
+    //   (m_loadError), and we will make use of it to recover the 'failingURL'.
+    // * If the 'failingURL' holds a null'ed string though, we fallback
+    //   to 'outgoingReferrer' (it yet is safer than originalRequest).
+    FrameLoader* loader = d->frame->loader();
+    FrameLoaderClientQt* loaderClient = d->frameLoaderClient;
+
+    if (!loader->activeDocumentLoader()
+        || !loaderClient->m_loadError.isNull()) {
+        if (!loaderClient->m_loadError.failingURL().isNull())
+            return QUrl(loaderClient->m_loadError.failingURL());
+        else if (!loader->outgoingReferrer().isEmpty())
+            return QUrl(loader->outgoingReferrer());
+    }
 
-    return d->frame->loader()->originalRequest().url();
+    return loader->originalRequest().url();
 }
 /*!
     \since 4.6
@@ -710,7 +721,9 @@ void QWebFrame::load(const QNetworkRequest &req,
   script can be specified through the charset attribute of the HTML script tag. It is also possible
   for the encoding to be specified by web server.
 
-  \sa toHtml()
+  \note This method will not affect session or global history for the frame.
+
+  \sa toHtml(), setContent()
 */
 void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
 {
@@ -718,7 +731,7 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
     WebCore::ResourceRequest request(kurl);
     const QByteArray utf8 = html.toUtf8();
     WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
-    WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), kurl);
+    WebCore::SubstituteData substituteData(data, WebCore::String("text/html"), WebCore::String("utf-8"), KURL());
     d->frame->loader()->load(request, substituteData, false);
 }
 
@@ -731,7 +744,9 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
 
   The \a data is loaded immediately; external objects are loaded asynchronously.
 
-  \sa toHtml()
+  \note This method will not affect session or global history for the frame.
+
+  \sa toHtml(), setHtml()
 */
 void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, const QUrl &baseUrl)
 {
@@ -741,11 +756,10 @@ void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, cons
     QString actualMimeType = mimeType;
     if (actualMimeType.isEmpty())
         actualMimeType = QLatin1String("text/html");
-    WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), kurl);
+    WebCore::SubstituteData substituteData(buffer, WebCore::String(actualMimeType), WebCore::String(), KURL());
     d->frame->loader()->load(request, substituteData, false);
 }
 
-
 /*!
   Returns the parent frame of this frame, or 0 if the frame is the web pages
   main frame.
@@ -1248,7 +1262,7 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValue v = d->frame->loader()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
+        JSC::JSValue v = d->frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
         int distance = 0;
         rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 655fd0e..31d193e 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -271,7 +271,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
     JSC::initializeThreading();
-    WebCore::FrameLoader::setLocalLoadPolicy(WebCore::FrameLoader::AllowLocalLoadsForLocalAndSubstituteData);
+    WebCore::SecurityOrigin::setLocalLoadPolicy(WebCore::SecurityOrigin::AllowLocalLoadsForLocalAndSubstituteData);
 
     chromeClient = new ChromeClientQt(q);
     contextMenuClient = new ContextMenuClientQt();
@@ -279,9 +279,6 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     page = new Page(chromeClient, contextMenuClient, editorClient,
                     new DragClientQt(q), new InspectorClientQt(q), 0);
 
-    // ### should be configurable
-    page->settings()->setDefaultTextEncodingName("iso-8859-1");
-
     settings = new QWebSettings(page->settings());
 
 #ifndef QT_NO_UNDOSTACK
@@ -461,10 +458,10 @@ void QWebPagePrivate::updateAction(QWebPage::WebAction action)
 
     switch (action) {
         case QWebPage::Back:
-            enabled = loader->canGoBackOrForward(-1);
+            enabled = page->canGoBackOrForward(-1);
             break;
         case QWebPage::Forward:
-            enabled = loader->canGoBackOrForward(1);
+            enabled = page->canGoBackOrForward(1);
             break;
         case QWebPage::Stop:
             enabled = loader->isLoading();
@@ -584,8 +581,6 @@ void QWebPagePrivate::timerEvent(QTimerEvent *ev)
 
 void QWebPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -606,8 +601,6 @@ void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
 
 void QWebPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -663,8 +656,6 @@ void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
 
 void QWebPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent *ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -750,8 +741,6 @@ void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
 
 void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -833,8 +822,6 @@ QMenu *QWebPage::createStandardContextMenu()
 #ifndef QT_NO_WHEELEVENT
 void QWebPagePrivate::wheelEvent(QGraphicsSceneWheelEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -990,8 +977,6 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent*)
 
 void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
@@ -1016,8 +1001,6 @@ void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
 
 void QWebPagePrivate::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
     page->dragController()->dragExited(&dragData);
@@ -1036,8 +1019,6 @@ void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
 
 void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
@@ -1863,7 +1844,7 @@ void QWebPage::triggerAction(WebAction action, bool)
                 WTF::RefPtr<WebCore::Frame> wcFrame = targetFrame->d->frame;
                 targetFrame->d->frame->loader()->loadFrameRequest(frameLoadRequest(d->hitTestResult.linkUrl(), wcFrame.get()),
                                                                   /*lockHistory*/ false, /*lockBackForwardList*/ false, /*event*/ 0,
-                                                                  /*FormState*/ 0);
+                                                                  /*FormState*/ 0, SendReferrer);
                 break;
             }
             // fall through
@@ -1975,7 +1956,7 @@ void QWebPage::setViewportSize(const QSize &size) const
     }
 }
 
-QSize QWebPage::fixedContentsSize() const
+QSize QWebPage::preferredContentsSize() const
 {
     QWebFrame* frame = d->mainFrame;
     if (frame) {
@@ -1988,7 +1969,7 @@ QSize QWebPage::fixedContentsSize() const
 }
 
 /*!
-    \property QWebPage::fixedContentsSize
+    \property QWebPage::preferredContentsSize
     \since 4.6
     \brief the size of the fixed layout
 
@@ -1996,7 +1977,7 @@ QSize QWebPage::fixedContentsSize() const
     1024x768 for example then webkit will layout the page as if the viewport were that size
     rather than something different.
 */
-void QWebPage::setFixedContentsSize(const QSize &size) const
+void QWebPage::setPreferredContentsSize(const QSize &size) const
 {
     d->fixedLayoutSize = size;
 
@@ -2684,6 +2665,43 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
 */
 
 /*!
+    \class QWebPage::ErrorPageExtensionOption
+    \since 4.6
+    \brief The ErrorPageExtensionOption class describes the option
+    for the error page extension.
+
+    \inmodule QtWebKit
+
+    The ErrorPageExtensionOption class holds the \a url for which an error occoured as well as
+    the associated \a frame.
+
+    The error itself is reported by an error \a domain, the \a error code as well as \a errorString.
+
+    \sa QWebPage::ErrorPageExtensionReturn
+*/
+
+/*!
+    \class QWebPage::ErrorPageExtensionReturn
+    \since 4.6
+    \brief The ErrorPageExtensionReturn describes the error page, which will be shown for the
+    frame for which the error occured.
+
+    \inmodule QtWebKit
+
+    The ErrorPageExtensionReturn class holds the data needed for creating an error page. Some are
+    optional such as \a contentType, which defaults to "text/html", as well as the \a encoding, which
+    is assumed to be UTF-8 if not indicated otherwise.
+
+    The error page is stored in the \a content byte array, as HTML content. In order to convert a
+    QString to a byte array, the QString::toUtf8() method can be used.
+
+    External objects such as stylesheets or images referenced in the HTML are located relative to
+    \a baseUrl.
+
+    \sa QWebPage::ErrorPageExtensionOption, QString::toUtf8()
+*/
+
+/*!
     \class QWebPage::ChooseMultipleFilesExtensionOption
     \since 4.5
     \brief The ChooseMultipleFilesExtensionOption class describes the option
@@ -2850,6 +2868,9 @@ QNetworkProxy QWebPage::networkProxy() const
     Sets the QNetworkAccessManager \a manager responsible for serving network requests for this
     QWebPage.
 
+    \note It is currently not supported to change the network access manager after the
+    QWebPage has used it. The results of doing this are undefined.
+
     \sa networkAccessManager()
 */
 void QWebPage::setNetworkAccessManager(QNetworkAccessManager *manager)
@@ -3359,6 +3380,16 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
+  \since 4.6
+  \fn void QWebPage::networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
+  \preliminary
+
+  This signal is emitted when a \a frame of the current page requests a web resource. The application
+  may want to associate the \a request with the \a frame that initiated it by storing the \a frame
+  as an attribute of the \a request.
+*/
+
+/*!
   \fn QWebPagePrivate* QWebPage::handle() const
   \internal
 */
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 41d1835..f2bbde0 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -56,6 +56,7 @@ namespace WebCore {
     class InspectorClientQt;
     class ResourceHandle;
     class HitTestResult;
+    class QNetworkReplyHandler;
 
     struct FrameLoadRequest;
 }
@@ -66,7 +67,7 @@ class QWEBKIT_EXPORT QWebPage : public QObject {
     Q_PROPERTY(bool modified READ isModified)
     Q_PROPERTY(QString selectedText READ selectedText)
     Q_PROPERTY(QSize viewportSize READ viewportSize WRITE setViewportSize)
-    Q_PROPERTY(QSize fixedContentsSize READ fixedContentsSize WRITE setFixedContentsSize)
+    Q_PROPERTY(QSize preferredContentsSize READ preferredContentsSize WRITE setPreferredContentsSize)
     Q_PROPERTY(bool forwardUnsupportedContent READ forwardUnsupportedContent WRITE setForwardUnsupportedContent)
     Q_PROPERTY(LinkDelegationPolicy linkDelegationPolicy READ linkDelegationPolicy WRITE setLinkDelegationPolicy)
     Q_PROPERTY(QPalette palette READ palette WRITE setPalette)
@@ -236,8 +237,8 @@ public:
     QSize viewportSize() const;
     void setViewportSize(const QSize &size) const;
 
-    QSize fixedContentsSize() const;
-    void setFixedContentsSize(const QSize &size) const;
+    QSize preferredContentsSize() const;
+    void setPreferredContentsSize(const QSize &size) const;
 
     virtual bool event(QEvent*);
     bool focusNextPrevChild(bool next);
@@ -288,6 +289,8 @@ public:
     enum ErrorDomain { QtNetwork, Http, WebKit };
     class ErrorPageExtensionOption : public ExtensionOption {
     public:
+        QUrl url;
+        QWebFrame* frame;
         ErrorDomain domain;
         int error;
         QString errorString;
@@ -344,6 +347,8 @@ Q_SIGNALS:
     void saveFrameStateRequested(QWebFrame* frame, QWebHistoryItem* item);
     void restoreFrameStateRequested(QWebFrame* frame);
 
+    void networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
+
 protected:
     virtual QWebPage *createWindow(WebWindowType type);
     virtual QObject *createPlugin(const QString &classid, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues);
@@ -378,6 +383,7 @@ private:
     friend class WebCore::FrameLoaderClientQt;
     friend class WebCore::InspectorClientQt;
     friend class WebCore::ResourceHandle;
+    friend class WebCore::QNetworkReplyHandler;
 };
 
 Q_DECLARE_OPERATORS_FOR_FLAGS(QWebPage::FindFlags)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
index eedf7d1..ffa21e4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
@@ -62,6 +62,8 @@ public:
     QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
+    float printingMinimumShrinkFactor;
+    float printingMaximumShrinkFactor;
 
     void apply();
     WebCore::Settings* settings;
@@ -174,6 +176,12 @@ void QWebSettingsPrivate::apply()
         QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
         settings->setLocalStorageDatabasePath(storagePath);
 
+        float minimumShrinkFactor = printingMinimumShrinkFactor > 0.0f ? printingMinimumShrinkFactor : global->printingMinimumShrinkFactor;
+        settings->setPrintingMinimumShrinkFactor(minimumShrinkFactor);
+
+        float maximumShrinkFactor = printingMaximumShrinkFactor > 0.0f ? printingMaximumShrinkFactor : global->printingMaximumShrinkFactor;
+        settings->setPrintingMaximumShrinkFactor(maximumShrinkFactor);
+
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
         settings->setZoomsTextOnly(value);
@@ -377,6 +385,9 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
     d->attributes.insert(QWebSettings::SessionStorageEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
+    d->defaultTextEncoding = QLatin1String("iso-8859-1");
+    d->printingMinimumShrinkFactor = 0.0f;
+    d->printingMaximumShrinkFactor = 0.0f;
 }
 
 /*!
@@ -491,6 +502,60 @@ QString QWebSettings::defaultTextEncoding() const
 }
 
 /*!
+    \since 4.7 
+    Specifies minimum shrink fator allowed for printing. If set to 0 a
+    default value is used.
+
+    When printing, content will be shrunk to reduce page usage, it
+    will reduced by a factor between printingMinimumShrinkFactor and
+    printingMaximumShrinkFactor. 
+
+    \sa printingMinimumShrinkFactor()
+    \sa setPrintingMaximumShrinkFactor()
+    \sa printingMaximumShrinkFactor()
+*/
+void QWebSettings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
+{
+    d->printingMinimumShrinkFactor = printingMinimumShrinkFactor;
+    d->apply();
+}
+
+/*!
+    \since 4.7 
+    returns the minimum shrink factor used for printing.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+float QWebSettings::printingMinimumShrinkFactor() const
+{
+    return d->printingMinimumShrinkFactor;
+}
+
+/*!
+    \since 4.7 
+    Specifies maximum shrink fator allowed for printing. If set to 0 a
+    default value is used.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+void QWebSettings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+{
+    d->printingMaximumShrinkFactor = printingMaximumShrinkFactor;
+    d->apply();
+}
+
+/*!
+    \since 4.7 
+    returns the maximum shrink factor used for printing.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+float QWebSettings::printingMaximumShrinkFactor() const
+{
+    return d->printingMaximumShrinkFactor;
+}
+
+/*!
     Sets the path of the icon database to \a path. The icon database is used
     to store "favicons" associated with web sites.
 
@@ -628,11 +693,6 @@ void QWebSettings::clearMemoryCaches()
     // Invalidating the font cache and freeing all inactive font data.
     WebCore::fontCache()->invalidate();
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    // Empty the application cache.
-    WebCore::cacheStorage().empty();
-#endif
-
     // Empty the Cross-Origin Preflight cache
     WebCore::CrossOriginPreflightResultCache::shared().empty();
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
index 4790823..e68ea53 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
@@ -103,6 +103,12 @@ public:
     void setDefaultTextEncoding(const QString &encoding);
     QString defaultTextEncoding() const;
 
+    void setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor);
+    float printingMinimumShrinkFactor() const;
+
+    void setPrintingMaximumShrinkFactor(float printingMaximimShrinkFactor);
+    float printingMaximumShrinkFactor() const;
+
     static void setIconDatabasePath(const QString &location);
     static QString iconDatabasePath();
     static void clearIconDatabase();
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 41067f1..f7caa94 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2008 Holger Hans Peter Freyther
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -52,11 +53,16 @@ public:
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
 #endif
 
+#ifndef QT_NO_CURSOR
     virtual QCursor cursor() const;
     virtual void updateCursor(const QCursor& cursor);
+#endif
 
+    virtual QPalette palette() const;
     virtual int screenNumber() const;
-    virtual WId winId() const;
+    virtual QWidget* ownerWidget() const;
+
+    virtual QObject* pluginParent() const;
 
     void _q_pageDestroyed();
 
@@ -89,7 +95,7 @@ void QWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
         view->setInputMethodHints(view->inputMethodHints() & ~hint);
 }
 #endif
-
+#ifndef QT_NO_CURSOR
 QCursor QWebViewPrivate::cursor() const
 {
     return view->cursor();
@@ -99,6 +105,12 @@ void QWebViewPrivate::updateCursor(const QCursor& cursor)
 {
     view->setCursor(cursor);
 }
+#endif
+
+QPalette QWebViewPrivate::palette() const
+{
+    return view->palette();
+}
 
 int QWebViewPrivate::screenNumber() const
 {
@@ -110,12 +122,14 @@ int QWebViewPrivate::screenNumber() const
     return 0;
 }
 
-WId QWebViewPrivate::winId() const
+QWidget* QWebViewPrivate::ownerWidget() const
 {
-    if (view)
-        return view->winId();
+    return view;
+}
 
-    return 0;
+QObject* QWebViewPrivate::pluginParent() const
+{
+    return view;
 }
 
 void QWebViewPrivate::_q_pageDestroyed()
@@ -137,7 +151,7 @@ void QWebViewPrivate::_q_pageDestroyed()
     It can be used in various applications to display web content live from the
     Internet.
 
-    The image below shows QWebView previewed in \QD with a Nokia website.
+    The image below shows QWebView previewed in \QD with the Trolltech website.
 
     \image qwebview-url.png
 
@@ -231,8 +245,10 @@ QWebView::QWebView(QWidget *parent)
 */
 QWebView::~QWebView()
 {
-    if (d->page)
+    if (d->page) {
         d->page->d->view = 0;
+        d->page->d->client = 0;
+    }
 
     if (d->page && d->page->parent() == this)
         delete d->page;
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 85d0e4f..7987613 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,334 @@
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Update call to FrameLoader::loadFrameRequest().
+
+        * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
+
+2009-10-19  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Add QWebElement::render API which allows rendering of single
+        element.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::render):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::render):
+        * tests/qwebelement/qwebelement.qrc:
+        * tests/qwebelement/image.png: Added.
+
+2009-10-19  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        QWebPage: Doc: setNetworkAccessManager should only be called once.
+
+        * Api/qwebpage.cpp:
+
+2009-10-19  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne.
+
+        Wrong ifdef combination in QGraphicsWebView's event method.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (takeScreenshot):
+        (tst_QWebPage::screenshot_data):
+        (tst_QWebPage::screenshot):
+        * tests/resources/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * Api/qwebview.cpp:
+        (QWebView::~QWebView):
+        * tests/qwebview/qwebview.pro:
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage_data):
+        (tst_QWebView::reusePage):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        Allow one to costumize the minimal and maximal shrink factors,
+        Added methods setPrintingMinimumShrinkFactor, printingMinimumShrinkFactor,
+        setPrintingMaximumShrinkFactor, printingMaximumShrinkFactor to QWebSettings.
+
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setPrintingMinimumShrinkFactor):
+        (QWebSettings::printingMinimumShrinkFactor):
+        (QWebSettings::setPrintingMaximumShrinkFactor):
+        (QWebSettings::printingMaximumShrinkFactor):
+        * Api/qwebsettings.h:
+
+2009-10-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Rename fixedContentsSize property to preferredContentsSize as
+        agreed upon with Simon Hausmann and Matthias Ettrich.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::preferredContentsSize):
+        (QWebPage::setPreferredContentsSize):
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):
+
+2009-10-16  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QGLauncher leaks WebPage object
+        https://bugs.webkit.org/show_bug.cgi?id=30465
+
+        Make 'SharedScene' to own 'WebPage' reference and delete it at its destructor.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::view):
+        * Api/qwebpage_p.h:
+        * QGVLauncher/main.cpp:
+        (SharedScene::SharedScene):
+        (SharedScene::~SharedScene):
+
+2009-10-16  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] "dangling" pointer to qwebpage's view object can leads QGLauncher to crash
+        https://bugs.webkit.org/show_bug.cgi?id=30459
+
+        Remove all setView(ev->widget()) calls in QWebPage and QGWV event handling methods,
+        since QWebPageClient would do the trick.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::hoverMoveEvent):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragLeaveEvent):
+        (QWebPagePrivate::dragMoveEvent):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * Api/qwebpage.cpp:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Added "c" style static methods for the application to hook up for
+        receiving notifications when a plugin is created or destroyed.
+
+        * Api/qwebpage.cpp:
+
+2009-10-15  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Rubberstamped by Tor Arne.
+
+        Make QGLauncher's WebPage class constructor to get a QObject* as parent (not QWidget*).
+
+        * QGVLauncher/main.cpp:
+        (WebPage::WebPage):
+
+2009-10-15  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne.
+
+        [Qt] QGLauncher crashes while closing a window
+        https://bugs.webkit.org/show_bug.cgi?id=30385
+
+        Set page's pageClient reference to '0' at QGWV deletion.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::~QGraphicsWebView):
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (WebPage::WebPage):
+        (WebPage::aborting):
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make context menu to work in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30336
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::ownerWidget):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::ownerWidget):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add some initial autotests for QWebPage's ErrorPageExtention
+        https://bugs.webkit.org/show_bug.cgi?id=30296
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ErrorPage::ErrorPage):
+        (ErrorPage::supportsExtension):
+        (ErrorPage::extension):
+        (tst_QWebPage::errorPageExtension):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] better handle possible edge cases on qwebframe::requestedUrl use
+        https://bugs.webkit.org/show_bug.cgi?id=30216
+
+        QWebFrame::requestedUrl can be called at any time during the load
+        process, including:
+
+        * An error handling (whereas an alternate error page for unsuccessful
+          load is being set);
+        * A ssl error exception call;
+        * During navigation notifications/callbacks (titleChanged, urlChanged,
+          progresses, addHistoryEntry, etc);
+        * Among others.
+
+        This patch makes requestedUrl calls to fallback to FrameLoaderClient
+        m_loadError's failingURL when an error has occurred, unless it is
+        null/empty.
+
+        Also, m_loadError is now being reset at each the main frame starts a
+        load, in order to avoid previous load errors footprints.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::postProgressStartedNotification):
+
+2009-10-12  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Missing default value for the default text encoding.
+        https://bugs.webkit.org/show_bug.cgi?id=30311
+
+        QtWebKit has provided a default, hardcoded value for default charset but since
+        the addition of the defaultTextEncoding setting in QWebSettings, that hardcoded
+        value has had no effect.
+
+        Added a regression test and unskipped fast/dom/Document/document-charset.html,
+        which is passing now.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::defaultTextEncoding):
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement the new palette() methods on the page clients
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::palette):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::palette):
+
+2009-10-12  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QWebPage's createViewlessPlugin autotest crash fix.
+        
+        It is possible that plugins that are QWidgets or QGraphicsWidgets
+        are created before a view has been assigned to a QWebPage. The
+        plug-ins won't be fully functional, as by design, they should
+        visualise something, but they won't crash and will stay in memory.
+
+        An autotest that covers this use-case, is included.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30118
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (PluginTrackedPageWidget::PluginTrackedPageWidget):
+        (PluginTrackedPageGraphicsWidget::PluginTrackedPageGraphicsWidget):
+        (PluginTrackedPageGraphicsWidget::createPlugin):
+        (tst_QWebPage::destroyPlugin):
+        (tst_QWebPage::createViewlessPlugin):
+
 2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -24,6 +355,130 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::inputMethods):
 
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+
+2009-10-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Part of testOptionalJSObjects autotest was marked as "expect to fail".
+
+        Two places in tst_QWebPage::testOptionalJSObjects were marked as
+        expected to fail. The problem concern checking if a feature is enabled
+        or disabled. According to discussion on webkit dev mailing list
+        a disabled feature should be invisible from java script level, but
+        there are exceptions from the rule. So we decided to disable the test
+        for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29867
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::testOptionalJSObjects):
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        Move the policy callback to the policy object.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callPolicyFunction):
+
+2009-10-07  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Get rid of useless loadFailed signal in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30166
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_doLoadFinished):
+        * Api/qgraphicswebview.h:
+        * QGVLauncher/main.cpp:
+        (MainWindow::init):
+        (MainWindow::loadFinished):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Add a simple rotation effect to QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=30162
+
+        * QGVLauncher/main.cpp:
+        (MainView::animatedFlip):
+        (MainWindow::animatedFlip):
+        (MainWindow::buildUI):
+
+2009-10-07  Volker Hilsheimer  <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: Document HTML and status as properties.
+
+        * Api/qgraphicswebview.cpp:
+
+2009-10-07  Martin Smith  <msmith@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix qdoc warning about disabled renderHints property
+        on Symbian.
+
+        * Api/qwebview.cpp:
+        * Api/qwebview.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        Call the new API.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        When the drag data contains an image set it on the QDrag so it will be visible to the user.
+        
+        * WebCoreSupport/DragClientQt.cpp:
+        (WebCore::DragClientQt::startDrag):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::createPage):
+
 2009-10-06  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
@@ -37,6 +492,159 @@
         * Api/qwebview.cpp:
         (QWebView::QWebView):
 
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        QtLauncher: print the number of loaded urls
+        
+        When using the -r mode print the number of URLs loaded so far. This
+        is extremly useful when opening the same URL over and over again and
+        one wants to see the progress.
+
+        * QtLauncher/main.cpp:
+        (URLLoader::URLLoader):
+        (URLLoader::loadNext):
+
+2009-10-05  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Add screenshot option to menubar
+
+        https://bugs.webkit.org/show_bug.cgi?id=30067
+
+        * QtLauncher/main.cpp:
+        (MainWindow::screenshot):
+        (MainWindow::setupUI):
+
+2009-10-05  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Setting the env QTLAUNCHER_USE_ARGB_VISUALS makes Qt use WA_TranslucentWindow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30068
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Simon Hausmann.
+
+        Add documentation to the ErrorPageExtension.
+
+        * Api/qwebpage.cpp:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Add a signal to QWebPage, to inform the application when a request is created.
+
+        * Api/qwebpage.cpp:
+        * Api/qwebpage.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadFinished):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        ErrorPageExtension: Add a pointer to the QWebFrame that had
+        an error.
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2009-10-05  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Do not empty the offline web appcache when clearing
+        memory caches. That one is not in memory, but stored
+        in sqlite.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::clearMemoryCaches):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added QGraphicsWidget-plugins support to FrameLoaderClientQt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::pluginParent):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::pluginParent):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::):
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Unreview build fix.  I wish I had a try server...
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::updateAction):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebview.cpp:
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::scrollBarMinimum):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::focusInEvent):
+        (QWebPagePrivate::focusOutEvent):
+        (QWebPagePrivate::leaveEvent):
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+        (QWebPage::triggerAction):
+        (QWebPage::acceptNavigationRequest):
+        (QWebPage::chooseFile):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+        (WebCore::ChromeClientQt::mouseDidMoveOverElement):
+        (WebCore::ChromeClientQt::reachedMaxAppCacheSize):
+        * WebCoreSupport/ContextMenuClientQt.cpp:
+        (WebCore::ContextMenuClientQt::downloadURL):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchWillPerformClientRedirect):
+        (WebCore::FrameLoaderClientQt::setMainFrameDocumentReady):
+        (WebCore::FrameLoaderClientQt::representationExistsForURLScheme):
+        (WebCore::FrameLoaderClientQt::generatedMIMETypeForURLScheme):
+        (WebCore::FrameLoaderClientQt::shouldGoToHistoryItem):
+        (WebCore::FrameLoaderClientQt::pluginWillHandleLoadError):
+        (WebCore::FrameLoaderClientQt::assignIdentifierToInitialRequest):
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoading):
+        (WebCore::FrameLoaderClientQt::createJavaAppletWidget):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::setAttachedWindowHeight):
+        (WebCore::InspectorClientQt::highlight):
+        (WebCore::InspectorClientQt::removeSetting):
+
 2009-10-01  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
@@ -49,6 +657,37 @@
         (QWebPagePrivate::handleSoftwareInputPanel):
         * Api/qwebpage_p.h:
 
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * Api/headers.pri:
+        * Api/qwebpage.h:
+        * Api/qwebgraphicsitem.cpp: Renamed.
+        * Api/qwebgraphicsitem.h: Renamed.
+        * WebKit/qt/QGVLauncher/main.cpp:
+        * tests/tests.pro:
+        * tests/qwebgraphicsitem/qwebgraphicsitem.pro: Renamed.
+        * tests/qwebgraphicsitem/tst_qwebgraphicsitem.cpp: Renamed.
+
+2009-10-01  Antonio Gomes   <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29248
+        [Qt] [API] Make it possible to have 'invisible' loads
+
+        Make QWebFrame's setHtml and setContent methods to not change
+        session and global history at all.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2009-10-01  Kristian Amlie  <kristian.amlie@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -85,6 +724,17 @@
         * tests/qwebpage/tst_qwebpage.cpp:
         (tst_QWebPage::inputMethods):
 
+2009-09-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add the failed URL to the ErrorPageExtension, as it is quite
+        useful for creating error pages.
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
 2009-09-29  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
 
         Reviewed by Tor Arne Vestbø.
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp b/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
deleted file mode 100644
index d7fae07..0000000
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.cpp
+++ /dev/null
@@ -1,460 +0,0 @@
-/*
- * kimgio import filter for MS Windows .ico files
- *
- * Distributed under the terms of the LGPL
- * Copyright (c) 2000 Malte Starostik <malte@kde.org>
- *
- */
-
-#include "config.h"
-#include "ICOHandler.h"
-
-#include <cstring>
-#include <cstdlib>
-#include <algorithm>
-#include <vector>
-
-#include <QtGui/QImage>
-#include <QtGui/QBitmap>
-#include <QtGui/QApplication>
-#include <QtCore/QVector>
-#include <QtGui/QDesktopWidget>
-
-namespace
-{
-    // Global header (see http://www.daubnet.com/formats/ICO.html)
-    struct IcoHeader
-    {
-        enum Type { Icon = 1, Cursor };
-        quint16 reserved;
-        quint16 type;
-        quint16 count;
-    };
-
-    inline QDataStream& operator >>( QDataStream& s, IcoHeader& h )
-    {
-        return s >> h.reserved >> h.type >> h.count;
-    }
-
-    // Based on qt_read_dib et al. from qimage.cpp
-    // (c) 1992-2002 Nokia Corporation and/or its subsidiary(-ies).
-    struct BMP_INFOHDR
-    {
-        static const quint32 Size = 40;
-        quint32  biSize;                // size of this struct
-        quint32  biWidth;               // pixmap width
-        quint32  biHeight;              // pixmap height
-        quint16  biPlanes;              // should be 1
-        quint16  biBitCount;            // number of bits per pixel
-        enum Compression { RGB = 0 };
-        quint32  biCompression;         // compression method
-        quint32  biSizeImage;           // size of image
-        quint32  biXPelsPerMeter;       // horizontal resolution
-        quint32  biYPelsPerMeter;       // vertical resolution
-        quint32  biClrUsed;             // number of colors used
-        quint32  biClrImportant;        // number of important colors
-    };
-    const quint32 BMP_INFOHDR::Size;
-
-    QDataStream& operator >>( QDataStream &s, BMP_INFOHDR &bi )
-    {
-        s >> bi.biSize;
-        if ( bi.biSize == BMP_INFOHDR::Size )
-        {
-            s >> bi.biWidth >> bi.biHeight >> bi.biPlanes >> bi.biBitCount;
-            s >> bi.biCompression >> bi.biSizeImage;
-            s >> bi.biXPelsPerMeter >> bi.biYPelsPerMeter;
-            s >> bi.biClrUsed >> bi.biClrImportant;
-        }
-        return s;
-    }
-
-#if 0
-    QDataStream &operator<<( QDataStream &s, const BMP_INFOHDR &bi )
-    {
-        s << bi.biSize;
-        s << bi.biWidth << bi.biHeight;
-        s << bi.biPlanes;
-        s << bi.biBitCount;
-        s << bi.biCompression;
-        s << bi.biSizeImage;
-        s << bi.biXPelsPerMeter << bi.biYPelsPerMeter;
-        s << bi.biClrUsed << bi.biClrImportant;
-        return s;
-    }
-#endif
-
-    // Header for every icon in the file
-    struct IconRec
-    {
-        unsigned char width;
-        unsigned char height;
-        quint16 colors;
-        quint16 hotspotX;
-        quint16 hotspotY;
-        quint32 size;
-        quint32 offset;
-    };
-
-    inline QDataStream& operator >>( QDataStream& s, IconRec& r )
-    {
-        return s >> r.width >> r.height >> r.colors
-                 >> r.hotspotX >> r.hotspotY >> r.size >> r.offset;
-    }
-
-    struct LessDifference
-    {
-        LessDifference( unsigned s, unsigned c )
-            : size( s ), colors( c ) {}
-
-        bool operator ()( const IconRec& lhs, const IconRec& rhs ) const
-        {
-            // closest size match precedes everything else
-            if ( std::abs( int( lhs.width - size ) ) <
-                 std::abs( int( rhs.width - size ) ) ) return true;
-            else if ( std::abs( int( lhs.width - size ) ) >
-                 std::abs( int( rhs.width - size ) ) ) return false;
-            else if ( colors == 0 )
-            {
-                // high/true color requested
-                if ( lhs.colors == 0 ) return true;
-                else if ( rhs.colors == 0 ) return false;
-                else return lhs.colors > rhs.colors;
-            }
-            else
-            {
-                // indexed icon requested
-                if ( lhs.colors == 0 && rhs.colors == 0 ) return false;
-                else if ( lhs.colors == 0 ) return false;
-                else return std::abs( int( lhs.colors - colors ) ) <
-                            std::abs( int( rhs.colors - colors ) );
-            }
-        }
-        unsigned size;
-        unsigned colors;
-    };
-
-    bool loadFromDIB( QDataStream& stream, const IconRec& rec, QImage& icon )
-    {
-        BMP_INFOHDR header;
-        stream >> header;
-        if ( stream.atEnd() || header.biSize != BMP_INFOHDR::Size ||
-             header.biSize > rec.size ||
-             header.biCompression != BMP_INFOHDR::RGB ||
-             ( header.biBitCount != 1 && header.biBitCount != 4 &&
-               header.biBitCount != 8 && header.biBitCount != 24 &&
-               header.biBitCount != 32 ) ) return false;
-
-        unsigned paletteSize, paletteEntries;
-
-        if (header.biBitCount > 8)
-        {
-            paletteEntries = 0;
-            paletteSize    = 0;
-        }
-        else
-        {
-            paletteSize    = (1 << header.biBitCount);
-            paletteEntries = paletteSize;
-            if (header.biClrUsed && header.biClrUsed < paletteSize)
-                paletteEntries = header.biClrUsed;
-        }
-
-        // Always create a 32-bit image to get the mask right
-        // Note: this is safe as rec.width, rec.height are bytes
-        icon = QImage( rec.width, rec.height, QImage::Format_ARGB32 );
-        if ( icon.isNull() ) return false;
-
-        QVector< QRgb > colorTable( paletteSize );
-
-        colorTable.fill( QRgb( 0 ) );
-        for ( unsigned i = 0; i < paletteEntries; ++i )
-        {
-            unsigned char rgb[ 4 ];
-            stream.readRawData( reinterpret_cast< char* >( &rgb ),
-                                 sizeof( rgb ) );
-            colorTable[ i ] = qRgb( rgb[ 2 ], rgb[ 1 ], rgb[ 0 ] );
-        }
-
-        unsigned bpl = ( rec.width * header.biBitCount + 31 ) / 32 * 4;
-
-        unsigned char* buf = new unsigned char[ bpl ];
-        for ( unsigned y = rec.height; !stream.atEnd() && y--; )
-        {
-            stream.readRawData( reinterpret_cast< char* >( buf ), bpl );
-            unsigned char* pixel = buf;
-            QRgb* p = reinterpret_cast< QRgb* >( icon.scanLine( y ) );
-            switch ( header.biBitCount )
-            {
-                case 1:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = colorTable[
-                            ( pixel[ x / 8 ] >> ( 7 - ( x & 0x07 ) ) ) & 1 ];
-                    break;
-                case 4:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        if ( x & 1 ) *p++ = colorTable[ pixel[ x / 2 ] & 0x0f ];
-                        else *p++ = colorTable[ pixel[ x / 2 ] >> 4 ];
-                    break;
-                case 8:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = colorTable[ pixel[ x ] ];
-                    break;
-                case 24:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = qRgb( pixel[ 3 * x + 2 ],
-                                     pixel[ 3 * x + 1 ],
-                                     pixel[ 3 * x ] );
-                    break;
-                case 32:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = qRgba( pixel[ 4 * x + 2 ],
-                                      pixel[ 4 * x + 1 ],
-                                      pixel[ 4 * x ],
-                                      pixel[ 4 * x  + 3] );
-                    break;
-            }
-        }
-        delete[] buf;
-
-        if ( header.biBitCount < 32 )
-        {
-            // Traditional 1-bit mask
-            bpl = ( rec.width + 31 ) / 32 * 4;
-            buf = new unsigned char[ bpl ];
-            for ( unsigned y = rec.height; y--; )
-            {
-                stream.readRawData( reinterpret_cast< char* >( buf ), bpl );
-                QRgb* p = reinterpret_cast< QRgb* >( icon.scanLine( y ) );
-                for ( unsigned x = 0; x < rec.width; ++x, ++p )
-                    if ( ( ( buf[ x / 8 ] >> ( 7 - ( x & 0x07 ) ) ) & 1 ) )
-                        *p &= RGB_MASK;
-            }
-            delete[] buf;
-        }
-        return true;
-    }
-}
-
-ICOHandler::ICOHandler()
-{
-}
-
-bool ICOHandler::canRead() const
-{
-    return canRead(device());
-}
-
-bool ICOHandler::read(QImage *outImage)
-{
-
-    qint64 offset = device()->pos();
-
-    QDataStream stream( device() );
-    stream.setByteOrder( QDataStream::LittleEndian );
-    IcoHeader header;
-    stream >> header;
-    if ( stream.atEnd() || !header.count ||
-         ( header.type != IcoHeader::Icon && header.type != IcoHeader::Cursor) )
-        return false;
-
-    unsigned requestedSize = 32;
-    unsigned requestedColors =  QApplication::desktop()->depth() > 8 ? 0 : QApplication::desktop()->depth();
-    int requestedIndex = -1;
-#if 0
-    if ( io->parameters() )
-    {
-        QStringList params = QString(io->parameters()).split( ';', QString::SkipEmptyParts );
-        QMap< QString, QString > options;
-        for ( QStringList::ConstIterator it = params.begin();
-              it != params.end(); ++it )
-        {
-            QStringList tmp = (*it).split( '=', QString::SkipEmptyParts );
-            if ( tmp.count() == 2 ) options[ tmp[ 0 ] ] = tmp[ 1 ];
-        }
-        if ( options[ "index" ].toUInt() )
-            requestedIndex = options[ "index" ].toUInt();
-        if ( options[ "size" ].toUInt() )
-            requestedSize = options[ "size" ].toUInt();
-        if ( options[ "colors" ].toUInt() )
-            requestedColors = options[ "colors" ].toUInt();
-    }
-#endif
-
-    typedef std::vector< IconRec > IconList;
-    IconList icons;
-    for ( unsigned i = 0; i < header.count; ++i )
-    {
-        if ( stream.atEnd() )
-            return false;
-        IconRec rec;
-        stream >> rec;
-        icons.push_back( rec );
-    }
-    IconList::const_iterator selected;
-    if (requestedIndex >= 0) {
-        selected = std::min( icons.begin() + requestedIndex, icons.end() );
-    } else {
-        selected = std::min_element( icons.begin(), icons.end(),
-                                     LessDifference( requestedSize, requestedColors ) );
-    }
-    if ( stream.atEnd() || selected == icons.end() ||
-         offset + selected->offset > device()->size() )
-        return false;
-
-    device()->seek( offset + selected->offset );
-    QImage icon;
-    if ( loadFromDIB( stream, *selected, icon ) )
-    {
-#ifndef QT_NO_IMAGE_TEXT
-        icon.setText( "X-Index", 0, QString::number( selected - icons.begin() ) );
-        if ( header.type == IcoHeader::Cursor )
-        {
-            icon.setText( "X-HotspotX", 0, QString::number( selected->hotspotX ) );
-            icon.setText( "X-HotspotY", 0, QString::number( selected->hotspotY ) );
-        }
-#endif
-        *outImage = icon;
-        return true;
-    }
-    return false;
-}
-
-bool ICOHandler::write(const QImage &/*image*/)
-{
-#if 0
-    if (image.isNull())
-        return;
-
-    QByteArray dibData;
-    QDataStream dib(dibData, QIODevice::ReadWrite);
-    dib.setByteOrder(QDataStream::LittleEndian);
-
-    QImage pixels = image;
-    QImage mask;
-    if (io->image().hasAlphaBuffer())
-        mask = image.createAlphaMask();
-    else
-        mask = image.createHeuristicMask();
-    mask.invertPixels();
-    for ( int y = 0; y < pixels.height(); ++y )
-        for ( int x = 0; x < pixels.width(); ++x )
-            if ( mask.pixel( x, y ) == 0 ) pixels.setPixel( x, y, 0 );
-
-    if (!qt_write_dib(dib, pixels))
-        return;
-
-   uint hdrPos = dib.device()->at();
-    if (!qt_write_dib(dib, mask))
-        return;
-    memmove(dibData.data() + hdrPos, dibData.data() + hdrPos + BMP_WIN + 8, dibData.size() - hdrPos - BMP_WIN - 8);
-    dibData.resize(dibData.size() - BMP_WIN - 8);
-
-    QDataStream ico(device());
-    ico.setByteOrder(QDataStream::LittleEndian);
-    IcoHeader hdr;
-    hdr.reserved = 0;
-    hdr.type = Icon;
-    hdr.count = 1;
-    ico << hdr.reserved << hdr.type << hdr.count;
-    IconRec rec;
-    rec.width = image.width();
-    rec.height = image.height();
-    if (image.numColors() <= 16)
-        rec.colors = 16;
-    else if (image.depth() <= 8)
-        rec.colors = 256;
-    else
-        rec.colors = 0;
-    rec.hotspotX = 0;
-    rec.hotspotY = 0;
-    rec.dibSize = dibData.size();
-    ico << rec.width << rec.height << rec.colors
-        << rec.hotspotX << rec.hotspotY << rec.dibSize;
-    rec.dibOffset = ico.device()->at() + sizeof(rec.dibOffset);
-    ico << rec.dibOffset;
-
-    BMP_INFOHDR dibHeader;
-    dib.device()->at(0);
-    dib >> dibHeader;
-    dibHeader.biHeight = image.height() << 1;
-    dib.device()->at(0);
-    dib << dibHeader;
-
-    ico.writeRawBytes(dibData.data(), dibData.size());
-    return true;
-#endif
-    return false;
-}
-
-QByteArray ICOHandler::name() const
-{
-    return "ico";
-}
-
-bool ICOHandler::canRead(QIODevice *device)
-{
-    if (!device) {
-        qWarning("ICOHandler::canRead() called with no device");
-        return false;
-    }
-
-    const qint64 oldPos = device->pos();
-
-    char head[8];
-    qint64 readBytes = device->read(head, sizeof(head));
-    const bool readOk = readBytes == sizeof(head);
-
-    if (device->isSequential()) {
-        while (readBytes > 0)
-            device->ungetChar(head[readBytes-- - 1]);
-    } else {
-        device->seek(oldPos);
-    }
-
-    if ( !readOk )
-        return false;
-
-    return head[2] == '\001' && head[3] == '\000' && // type should be 1
-        ( head[6] == 16 || head[6] == 32 || head[6] == 64 ) && // width can only be one of those
-        ( head[7] == 16 || head[7] == 32 || head[7] == 64 );   // same for height
-}
-
-class ICOPlugin : public QImageIOPlugin
-{
-public:
-    QStringList keys() const;
-    Capabilities capabilities(QIODevice *device, const QByteArray &format) const;
-    QImageIOHandler *create(QIODevice *device, const QByteArray &format = QByteArray()) const;
-};
-
-QStringList ICOPlugin::keys() const
-{
-    return QStringList() << "ico" << "ICO";
-}
-
-QImageIOPlugin::Capabilities ICOPlugin::capabilities(QIODevice *device, const QByteArray &format) const
-{
-    if (format == "ico" || format == "ICO")
-        return Capabilities(CanRead);
-    if (!format.isEmpty())
-        return 0;
-    if (!device->isOpen())
-        return 0;
-
-    Capabilities cap;
-    if (device->isReadable() && ICOHandler::canRead(device))
-        cap |= CanRead;
-    return cap;
-}
-
-QImageIOHandler *ICOPlugin::create(QIODevice *device, const QByteArray &format) const
-{
-    QImageIOHandler *handler = new ICOHandler;
-    handler->setDevice(device);
-    handler->setFormat(format);
-    return handler;
-}
-
-Q_EXPORT_STATIC_PLUGIN(ICOPlugin)
-Q_EXPORT_PLUGIN2(qtwebico, ICOPlugin)
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.h b/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.h
deleted file mode 100644
index 4f1f1d6..0000000
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/ICOHandler.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * ico.h - kimgio import filter for MS Windows .ico files
- *
- * Distributed under the terms of the LGPL
- * Copyright (c) 2000 Malte Starostik <malte@kde.org>
- *
- */
-
-// You can use QImageIO::setParameters() to request a specific
-// Icon out of an .ico file:
-//
-// Options consist of a name=value pair and are separated by a semicolon.
-// Available options are:
-//     size=<size>   select the icon that most closely matches <size> (pixels)
-//                   default: 32
-//     colors=<num>  select the icon that has <num> colors (or comes closest)
-//                   default: 1 << display depth or 0 (RGB) if display depth > 8
-//     index=<index> select the indexth icon from the file. If this option
-//                   is present, the size and colors options will be ignored.
-//                   default: none
-// If both size and colors are given, size takes precedence.
-//
-// The old format is still supported:
-//     the parameters consist of a single string in the form
-//     "<size>[:<colors>]" which correspond to the options above
-//
-// If an icon was returned (i.e. the file is valid and the index option
-// if present was not out of range), the icon's index within the .ico
-// file is returned in the text tag "X-Index" of the image.
-// If the icon is in fact a cursor, its hotspot coordinates are returned
-// in the text tags "X-HotspotX" and "X-HotspotY".
-
-#ifndef _ICOHANDLER_H_
-#define _ICOHANDLER_H_
-
-#include <QtGui/QImageIOPlugin>
-
-class ICOHandler : public QImageIOHandler
-{
-public:
-    ICOHandler();
-
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
-
-    QByteArray name() const;
-
-    static bool canRead(QIODevice *device);
-};
-
-#endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Plugins/Plugins.pro b/src/3rdparty/webkit/WebKit/qt/Plugins/Plugins.pro
deleted file mode 100644
index a9b4f82..0000000
--- a/src/3rdparty/webkit/WebKit/qt/Plugins/Plugins.pro
+++ /dev/null
@@ -1,14 +0,0 @@
-TEMPLATE = lib
-TARGET = qtwebico
-CONFIG += plugin
-HEADERS += ICOHandler.h
-SOURCES += ICOHandler.cpp
-
-include(../../WebKit.pri)
-
-contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols 
-unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
-
-target.path = $$[QT_INSTALL_PLUGINS]/imageformats
-INSTALLS += target
-
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
index 0df0768..99e438d 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/DragClientQt.cpp
@@ -66,6 +66,8 @@ void DragClientQt::startDrag(DragImageRef, const IntPoint&, const IntPoint&, Cli
     QWidget* view = m_webPage->view();
     if (view) {
         QDrag *drag = new QDrag(view);
+        if (clipboardData->hasImage())
+            drag->setPixmap(qvariant_cast<QPixmap>(clipboardData->imageData()));
         drag->setMimeData(clipboardData);
         drag->start();
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 905e11d..81ccbe8 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -55,8 +55,10 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 #include "ScriptString.h"
+#include "QWebPageClient.h"
 
 #include "qwebpage.h"
+#include "qwebpage_p.h"
 #include "qwebframe.h"
 #include "qwebframe_p.h"
 #include "qwebhistoryinterface.h"
@@ -67,6 +69,8 @@
 #include <QCoreApplication>
 #include <QDebug>
 #if QT_VERSION >= 0x040400
+#include <QGraphicsScene>
+#include <QGraphicsWidget>
 #include <QNetworkRequest>
 #include <QNetworkReply>
 #else
@@ -183,7 +187,7 @@ QWebFrame* FrameLoaderClientQt::webFrame() const
 
 void FrameLoaderClientQt::callPolicyFunction(FramePolicyFunction function, PolicyAction action)
 {
-    (m_frame->loader()->*function)(action);
+    (m_frame->loader()->policyChecker()->*function)(action);
 }
 
 bool FrameLoaderClientQt::hasWebView() const
@@ -210,12 +214,12 @@ void FrameLoaderClientQt::transitionToCommittedForNewPage()
     QColor backgroundColor = brush.style() == Qt::SolidPattern ? brush.color() : QColor();
 
     QWebPage* page = m_webFrame->page();
-    const QSize fixedLayoutSize = page->fixedContentsSize();
+    const QSize preferredLayoutSize = page->preferredContentsSize();
 
     m_frame->createView(m_webFrame->page()->viewportSize(),
                         backgroundColor, !backgroundColor.alpha(),
-                        fixedLayoutSize.isValid() ? IntSize(fixedLayoutSize) : IntSize(),
-                        fixedLayoutSize.isValid(),
+                        preferredLayoutSize.isValid() ? IntSize(preferredLayoutSize) : IntSize(),
+                        preferredLayoutSize.isValid(),
                         (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Horizontal),
                         (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Vertical));
 }
@@ -374,7 +378,8 @@ void FrameLoaderClientQt::dispatchDidFinishLoad()
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFinishLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadError = ResourceError(); // clears the previous error
+    // Clears the previous error.
+    m_loadError = ResourceError();
 
     if (!m_webFrame)
         return;
@@ -428,6 +433,8 @@ void FrameLoaderClientQt::revertToProvisionalState(DocumentLoader*)
 void FrameLoaderClientQt::postProgressStartedNotification()
 {
     if (m_webFrame && m_frame->page()) {
+        // A new load starts, so lets clear the previous error.
+        m_loadError = ResourceError();
         emit loadStarted();
         postProgressEstimateChangedNotification();
     }
@@ -875,6 +882,8 @@ void FrameLoaderClientQt::callErrorPageExtension(const WebCore::ResourceError& e
         else
             return;
 
+        option.url = QUrl(error.failingURL());
+        option.frame = m_webFrame;
         option.error = error.errorCode();
         option.errorString = error.localizedDescription();
 
@@ -883,7 +892,7 @@ void FrameLoaderClientQt::callErrorPageExtension(const WebCore::ResourceError& e
             return;
 
         KURL baseUrl(output.baseUrl);
-        KURL failingUrl(QUrl(error.failingURL()));
+        KURL failingUrl(option.url);
 
         WebCore::ResourceRequest request(baseUrl);
         WTF::RefPtr<WebCore::SharedBuffer> buffer = WebCore::SharedBuffer::create(output.content.constData(), output.content.length());
@@ -1116,6 +1125,53 @@ public:
     }
 };
 
+#if QT_VERSION >= 0x040600
+class QtPluginGraphicsWidget: public Widget
+{
+public:
+    static RefPtr<QtPluginGraphicsWidget> create(QGraphicsWidget* w = 0)
+    {
+        return adoptRef(new QtPluginGraphicsWidget(w));
+    }
+
+    ~QtPluginGraphicsWidget()
+    {
+        if (graphicsWidget)
+            graphicsWidget->deleteLater();
+    }
+    virtual void invalidateRect(const IntRect& r)
+    {
+        QGraphicsScene* scene = graphicsWidget ? graphicsWidget->scene() : 0;
+        if (scene)
+            scene->update(QRect(r));
+    }
+    virtual void frameRectsChanged()
+    {
+        if (!graphicsWidget)
+            return;
+
+        IntRect windowRect = convertToContainingWindow(IntRect(0, 0, frameRect().width(), frameRect().height()));
+        graphicsWidget->setGeometry(QRect(windowRect));
+
+        // FIXME: clipping of graphics widgets
+    }
+    virtual void show()
+    {
+        if (graphicsWidget)
+            graphicsWidget->show();
+    }
+    virtual void hide()
+    {
+        if (graphicsWidget)
+            graphicsWidget->hide();
+    }
+private:
+    QtPluginGraphicsWidget(QGraphicsWidget* w = 0): Widget(0), graphicsWidget(w) {}
+
+    QGraphicsWidget* graphicsWidget;
+};
+#endif
+
 PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
                                           const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
@@ -1177,15 +1233,34 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
         if (object) {
             QWidget* widget = qobject_cast<QWidget*>(object);
             if (widget) {
-                QWidget* view = m_webFrame->page()->view();
-                if (view)
-                    widget->setParent(view);
+                QWidget* parentWidget;
+                if (m_webFrame->page()->d->client)
+                    parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
+                else
+                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
+                widget->setParent(parentWidget);
                 RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
                 w->setPlatformWidget(widget);
                 // Make sure it's invisible until properly placed into the layout
                 w->setFrameRect(IntRect(0, 0, 0, 0));
                 return w;
             }
+#if QT_VERSION >= 0x040600
+            QGraphicsWidget* graphicsWidget = qobject_cast<QGraphicsWidget*>(object);
+            if (graphicsWidget) {
+                QGraphicsObject* parentWidget;
+                if (m_webFrame->page()->d->client)
+                    parentWidget = qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent());
+                else
+                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
+                graphicsWidget->hide();
+                graphicsWidget->setParentItem(parentWidget);
+                RefPtr<QtPluginGraphicsWidget> w = QtPluginGraphicsWidget::create(graphicsWidget);
+                // Make sure it's invisible until properly placed into the layout
+                w->setFrameRect(IntRect(0, 0, 0, 0));
+                return w;
+            }
+#endif
             // FIXME: make things work for widgetless plugins as well
             delete object;
     } else { // NPAPI Plugins
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 3931a85..12f405c 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -84,9 +84,6 @@ void InspectorClientQt::inspectorDestroyed()
 
 Page* InspectorClientQt::createPage()
 {
-    if (m_inspectorView)
-        return m_inspectorView->page()->d->page;
-
     QWebView* inspectorView = new QWebView;
     InspectorClientWebPage* inspectorPage = new InspectorClientWebPage(inspectorView);
     inspectorView->setPage(inspectorPage);
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index 1a57286..4bdb7f5 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -19,7 +19,33 @@
 
 #include <QtTest/QtTest>
 
+#include <QGraphicsView>
 #include <qgraphicswebview.h>
+#include <qwebpage.h>
+#include <qwebframe.h>
+
+/**
+ * Starts an event loop that runs until the given signal is received.
+ * Optionally the event loop
+ * can return earlier on a timeout.
+ *
+ * \return \p true if the requested signal was received
+ *         \p false on timeout
+ */
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
+{
+    QEventLoop loop;
+    QObject::connect(obj, signal, &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
 
 class tst_QGraphicsWebView : public QObject
 {
@@ -27,6 +53,7 @@ class tst_QGraphicsWebView : public QObject
 
 private slots:
     void qgraphicswebview();
+    void crashOnViewlessWebPages();
 };
 
 void tst_QGraphicsWebView::qgraphicswebview()
@@ -53,6 +80,55 @@ void tst_QGraphicsWebView::qgraphicswebview()
     item.setContent(QByteArray());
 }
 
+class WebPage : public QWebPage
+{
+    Q_OBJECT
+
+public:
+    WebPage(QObject* parent = 0): QWebPage(parent)
+    {
+    }
+
+    QGraphicsWebView* webView;
+
+private slots:
+    // Force a webview deletion during the load.
+    // It should not cause WebPage to crash due to
+    // it accessing invalid pageClient pointer.
+    void aborting()
+    {
+        delete webView;
+    }
+};
+
+void tst_QGraphicsWebView::crashOnViewlessWebPages()
+{
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    QGraphicsWebView* webView = new QGraphicsWebView;
+    WebPage* page = new WebPage;
+    webView->setPage(page);
+    page->webView = webView;
+    connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), page, SLOT(aborting()));
+
+    scene.addItem(webView);
+
+    view.setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
+    view.resize(600, 480);
+    webView->resize(view.geometry().size());
+    QTest::qWait(200);
+    view.show();
+
+    page->mainFrame()->setHtml(QString("data:text/html,"
+                                            "<frameset cols=\"25%,75%\">"
+                                                "<frame src=\"data:text/html,foo \">"
+                                                "<frame src=\"data:text/html,bar\">"
+                                            "</frameset>"));
+
+    QVERIFY(::waitForSignal(page, SIGNAL(loadFinished(bool))));
+}
+
 QTEST_MAIN(tst_QGraphicsWebView)
 
 #include "tst_qgraphicswebview.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png
new file mode 100644
index 0000000..8d70364
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/image.png
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
index ed01440..28b9d7b 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.qrc
@@ -2,5 +2,6 @@
 <qresource prefix="/">
 <file>style.css</file>
 <file>style2.css</file>
+<file>image.png</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index 00783d1..db2f7d7 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -87,6 +87,7 @@ private slots:
     void firstChildNextSibling();
     void lastChildPreviousSibling();
     void hasSetFocus();
+    void render();
 
 private:
     QWebView* m_view;
@@ -825,5 +826,79 @@ void tst_QWebElement::hasSetFocus()
     QVERIFY(input2.hasFocus());
 }
 
+void tst_QWebElement::render()
+{
+    QString html( "<html>"
+                    "<head><style>"
+                       "body, iframe { margin: 0px; border: none; }"
+                    "</style></head>"
+                    "<body><table width='300px' height='300px' border='1'>"
+                           "<tr>"
+                               "<td>test"
+                               "</td>"
+                               "<td><img src='qrc:///image.png'>"
+                               "</td>"
+                           "</tr>"
+                          "</table>"
+                    "</body>"
+                 "</html>"
+                );
+
+    QWebPage page;
+    QSignalSpy loadSpy(&page, SIGNAL(loadFinished(bool)));
+    page.mainFrame()->setHtml(html);
+
+    waitForSignal(&page, SIGNAL(loadFinished(bool)));
+    QCOMPARE(loadSpy.count(), 1);
+
+    QList<QWebElement> imgs = page.mainFrame()->findAllElements("img");
+    QCOMPARE(imgs.count(), 1);
+
+    QImage resource(":/image.png");
+    QRect imageRect(0, 0, resource.width(), resource.height());
+
+    QImage testImage(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter0(&testImage);
+    painter0.fillRect(imageRect, Qt::white);
+    painter0.drawImage(0, 0, resource);
+    painter0.end();
+
+    QImage image1(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter1(&image1);
+    painter1.fillRect(imageRect, Qt::white);
+    imgs[0].render(&painter1);
+    painter1.end();
+
+    QVERIFY(image1 == testImage);
+
+    // render image 2nd time to make sure that cached rendering works fine
+    QImage image2(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter2(&image2);
+    painter2.fillRect(imageRect, Qt::white);
+    imgs[0].render(&painter2);
+    painter2.end();
+
+    QVERIFY(image2 == testImage);
+
+    // compare table rendered through QWebElement::render to whole page table rendering
+    QRect tableRect(0, 0, 300, 300);
+    QList<QWebElement> tables = page.mainFrame()->findAllElements("table");
+    QCOMPARE(tables.count(), 1);
+
+    QImage image3(300, 300, QImage::Format_ARGB32);
+    QPainter painter3(&image3);
+    painter3.fillRect(tableRect, Qt::white);
+    tables[0].render(&painter3);
+    painter3.end();
+
+    QImage image4(300, 300, QImage::Format_ARGB32);
+    QPainter painter4(&image4);
+    page.mainFrame()->setClipRenderToViewport(false);
+    page.mainFrame()->render(&painter4, tableRect);
+    painter4.end();
+
+    QVERIFY(image3 == image4);
+}
+
 QTEST_MAIN(tst_QWebElement)
 #include "tst_qwebelement.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
index 81037c3..4c92e91 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -5,5 +5,6 @@ SOURCES  += tst_qwebframe.cpp
 RESOURCES += qwebframe.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
 
 symbian:TARGET.UID3 = 0xA000E53D
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 797446b..80c9d72 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -586,6 +586,7 @@ private slots:
     void javaScriptWindowObjectClearedOnEvaluate();
     void setHtml();
     void setHtmlWithResource();
+    void setHtmlWithBaseURL();
     void ipv6HostEncoding();
     void metaData();
     void popupFocus();
@@ -699,6 +700,7 @@ void tst_QWebFrame::init()
     m_page = m_view->page();
     m_myObject = new MyQObject();
     m_page->mainFrame()->addToJavaScriptWindowObject("myObject", m_myObject);
+    QDir::setCurrent(SRCDIR);
 }
 
 void tst_QWebFrame::cleanup()
@@ -2370,6 +2372,28 @@ void tst_QWebFrame::setHtmlWithResource()
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 }
 
+void tst_QWebFrame::setHtmlWithBaseURL()
+{
+    QString html("<html><body><p>hello world</p><img src='resources/image2.png'/></body></html>");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+
+    // in few seconds, the image should be completey loaded
+    QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
+
+    frame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    QTest::qWait(200);
+    QCOMPARE(spy.count(), 1);
+
+    QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].width").toInt(), 128);
+    QCOMPARE(frame->evaluateJavaScript("document.images[0].height").toInt(), 128);
+
+    // no history item has to be added.
+    QCOMPARE(m_view->page()->history()->count(), 0);
+}
+
 class TestNetworkManager : public QNetworkAccessManager
 {
 public:
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
index 82ffac6..101837a 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -5,5 +5,6 @@ SOURCES  += tst_qwebpage.cpp
 RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
 symbian:TARGET.UID3 = 0xA000E53E
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index bdcc27f..21b3bc7 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,6 +24,7 @@
 #include <qwebelement.h>
 #include <qwebpage.h>
 #include <qwidget.h>
+#include <QGraphicsWidget>
 #include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebhistory.h>
@@ -33,6 +35,7 @@
 #include <qwebsecurityorigin.h>
 #include <qwebdatabase.h>
 #include <QPushButton>
+#include <QDir>
 
 // Will try to wait for the condition while allowing event processing
 #define QTRY_COMPARE(__expr, __expected) \
@@ -101,7 +104,9 @@ private slots:
     void contextMenuCrash();
     void database();
     void createPlugin();
+    void destroyPlugin_data();
     void destroyPlugin();
+    void createViewlessPlugin_data();
     void createViewlessPlugin();
     void multiplePageGroupsAndLocalStorage();
     void cursorMovements();
@@ -116,9 +121,14 @@ private slots:
     void testEnablePersistentStorage();
     void consoleOutput();
     void inputMethods();
+    void defaultTextEncoding();
+    void errorPageExtension();
 
     void crashTests_LazyInitializationOfMainFrame();
 
+    void screenshot_data();
+    void screenshot();
+
 private:
     QWebView* m_view;
     QWebPage* m_page;
@@ -222,6 +232,9 @@ void tst_QWebPage::infiniteLoopJS()
 
 void tst_QWebPage::loadFinished()
 {
+    qRegisterMetaType<QWebFrame*>("QWebFrame*");
+    qRegisterMetaType<QNetworkRequest*>("QNetworkRequest*");
+    QSignalSpy spyNetworkRequestStarted(m_page, SIGNAL(networkRequestStarted(QWebFrame*, QNetworkRequest*)));
     QSignalSpy spyLoadStarted(m_view, SIGNAL(loadStarted()));
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
@@ -232,6 +245,7 @@ void tst_QWebPage::loadFinished()
 
     QTest::qWait(3000);
 
+    QVERIFY(spyNetworkRequestStarted.count() > 1);
     QVERIFY(spyLoadStarted.count() > 1);
     QVERIFY(spyLoadFinished.count() > 1);
 
@@ -617,50 +631,93 @@ void tst_QWebPage::createPlugin()
     QCOMPARE(newPage->calls.count(), 0);
 }
 
-class PluginTrackedPage : public QWebPage
-{
+
+// Standard base class for template PluginTracerPage. In tests it is used as interface.
+class PluginCounterPage : public QWebPage {
 public:
+    int m_count;
+    QPointer<QObject> m_widget;
+    PluginCounterPage(QObject* parent = 0) : QWebPage(parent), m_count(0), m_widget(0)
+    {
+       settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    }
+};
 
-    int count;
-    QPointer<QWidget> widget;
+template<class T>
+class PluginTracerPage : public PluginCounterPage {
+public:
+    PluginTracerPage(QObject* parent = 0) : PluginCounterPage(parent) {}
+    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&)
+    {
+        m_count++;
+        return m_widget = new T();
+    }
+};
 
-    PluginTrackedPage(QWidget *parent = 0) : QWebPage(parent), count(0) {
-       settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+class PluginFactory {
+public:
+    enum FactoredType {QWidgetType, QGraphicsWidgetType};
+    static PluginCounterPage* create(FactoredType type, QObject* parent = 0)
+    {
+        PluginCounterPage* result = 0;
+        switch (type) {
+        case QWidgetType:
+            result = new PluginTracerPage<QWidget>(parent);
+            break;
+        case QGraphicsWidgetType:
+            result = new PluginTracerPage<QGraphicsWidget>(parent);
+            break;
+        default: {/*Oops*/};
+        }
+        return result;
     }
 
-    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&) {
-       count++;
-       QWidget *w = new QWidget;
-       widget = w;
-       return w;
+    static void prepareTestData()
+    {
+        QTest::addColumn<int>("type");
+        QTest::newRow("QWidget") << (int)PluginFactory::QWidgetType;
+        QTest::newRow("QGraphicsWidget") << (int)PluginFactory::QGraphicsWidgetType;
     }
 };
 
+void tst_QWebPage::destroyPlugin_data()
+{
+    PluginFactory::prepareTestData();
+}
+
 void tst_QWebPage::destroyPlugin()
 {
-    PluginTrackedPage* page = new PluginTrackedPage(m_view);
+    QFETCH(int, type);
+    PluginCounterPage* page = PluginFactory::create((PluginFactory::FactoredType)type, m_view);
     m_view->setPage(page);
 
     // we create the plugin, so the widget should be constructed
     QString content("<html><body><object type=\"application/x-qt-plugin\" classid=\"QProgressBar\"></object></body></html>");
     m_view->setHtml(content);
-    QVERIFY(page->widget != 0);
-    QCOMPARE(page->count, 1);
+    QVERIFY(page->m_widget);
+    QCOMPARE(page->m_count, 1);
 
     // navigate away, the plugin widget should be destructed
     m_view->setHtml("<html><body>Hi</body></html>");
     QTestEventLoop::instance().enterLoop(1);
-    QVERIFY(page->widget == 0);
+    QVERIFY(!page->m_widget);
+}
+
+void tst_QWebPage::createViewlessPlugin_data()
+{
+    PluginFactory::prepareTestData();
 }
 
 void tst_QWebPage::createViewlessPlugin()
 {
-    PluginTrackedPage* page = new PluginTrackedPage;
+    QFETCH(int, type);
+    PluginCounterPage* page = PluginFactory::create((PluginFactory::FactoredType)type);
     QString content("<html><body><object type=\"application/x-qt-plugin\" classid=\"QProgressBar\"></object></body></html>");
     page->mainFrame()->setHtml(content);
-    QCOMPARE(page->count, 1);
-    QVERIFY(page->widget != 0);
+    QCOMPARE(page->m_count, 1);
+    QVERIFY(page->m_widget);
     delete page;
+
 }
 
 // import private API
@@ -1370,8 +1427,10 @@ void tst_QWebPage::testOptionalJSObjects()
     webPage1.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
     webPage2.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
 
+    QEXPECT_FAIL("","Feature enabled/disabled checking problem. Look at bugs.webkit.org/show_bug.cgi?id=29867", Continue);
     QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
     QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", true),  true);
+    QEXPECT_FAIL("","Feature enabled/disabled checking problem. Look at bugs.webkit.org/show_bug.cgi?id=29867", Continue);
     QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
     QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), true);
 
@@ -1410,6 +1469,79 @@ void tst_QWebPage::testEnablePersistentStorage()
     QVERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
 }
 
+void tst_QWebPage::defaultTextEncoding()
+{
+    QWebFrame* mainFrame = m_page->mainFrame();
+
+    QString defaultCharset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QVERIFY(!defaultCharset.isEmpty());
+    QCOMPARE(QWebSettings::globalSettings()->defaultTextEncoding(), defaultCharset);
+
+    m_page->settings()->setDefaultTextEncoding(QString("utf-8"));
+    QString charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QCOMPARE(charset, QString("utf-8"));
+    QCOMPARE(m_page->settings()->defaultTextEncoding(), charset);
+
+    m_page->settings()->setDefaultTextEncoding(QString());
+    charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QVERIFY(!charset.isEmpty());
+    QCOMPARE(charset, defaultCharset);
+
+    QWebSettings::globalSettings()->setDefaultTextEncoding(QString("utf-8"));
+    charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QCOMPARE(charset, QString("utf-8"));
+    QCOMPARE(QWebSettings::globalSettings()->defaultTextEncoding(), charset);
+}
+
+class ErrorPage : public QWebPage
+{
+public:
+
+    ErrorPage(QWidget* parent = 0): QWebPage(parent)
+    {
+    }
+
+    virtual bool supportsExtension(Extension extension) const
+    {
+        return extension == ErrorPageExtension;
+    }
+
+    virtual bool extension(Extension, const ExtensionOption* option, ExtensionReturn* output)
+    {
+        const ErrorPageExtensionOption* info = static_cast<const ErrorPageExtensionOption*>(option);
+        ErrorPageExtensionReturn* errorPage = static_cast<ErrorPageExtensionReturn*>(output);
+
+        if (info->frame == mainFrame()) {
+            errorPage->content = "data:text/html,error";
+            return true;
+        }
+
+        return false;
+    }
+};
+
+void tst_QWebPage::errorPageExtension()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+
+    page->mainFrame()->load(QUrl("qrc:///frametest/index.html"));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+
+    page->mainFrame()->setUrl(QUrl("http://non.existent/url"));
+    QTest::qWait(2000);
+    QTRY_COMPARE(spyLoadFinished.count(), 2);
+    QCOMPARE(page->mainFrame()->toPlainText(), QString("data:text/html,error"));
+    QCOMPARE(page->history()->count(), 2);
+    QCOMPARE(page->history()->currentItem().url(), QUrl("http://non.existent/url"));
+    QCOMPARE(page->history()->canGoBack(), true);
+    QCOMPARE(page->history()->canGoForward(), false);
+
+    m_view->setPage(0);
+}
+
 void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
 {
     {
@@ -1430,6 +1562,52 @@ void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
     }
 }
 
+static void takeScreenshot(QWebPage* page)
+{
+    QWebFrame* mainFrame = page->mainFrame();
+    page->setViewportSize(mainFrame->contentsSize());
+    QImage image(page->viewportSize(), QImage::Format_ARGB32);
+    QPainter painter(&image);
+    mainFrame->render(&painter);
+    painter.end();
+}
+
+void tst_QWebPage::screenshot_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::newRow("WithoutPlugin") << "<html><body id='b'>text</body></html>";
+    QTest::newRow("WindowedPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf'></embed></body></html>");
+    QTest::newRow("WindowlessPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf' wmode='transparent'></embed></body></html>");
+}
+
+void tst_QWebPage::screenshot()
+{
+    QDir::setCurrent(SRCDIR);
+
+    QFETCH(QString, html);
+    QWebPage* page = new QWebPage;
+    page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* mainFrame = page->mainFrame();
+    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    if (html.contains("</embed>")) {
+        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
+        QTest::qWait(2000);
+    }
+
+    // take screenshot without a view
+    takeScreenshot(page);
+
+    QWebView* view = new QWebView;
+    view->setPage(page);
+
+    // take screenshot when attached to a view
+    takeScreenshot(page);
+
+    delete page;
+    delete view;
+
+    QDir::setCurrent(QApplication::applicationDirPath());
+}
 
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
index d9d122c..bba7c39 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
@@ -4,5 +4,6 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
 symbian:TARGET.UID3 = 0xA000E53F
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 01d0e92..9204223 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2009 Torch Mobile Inc.
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@
 #include <qnetworkrequest.h>
 #include <qdiriterator.h>
 #include <qwebkitversion.h>
+#include <qwebframe.h>
 
 class tst_QWebView : public QObject
 {
@@ -42,6 +44,9 @@ private slots:
     void guessUrlFromString_data();
     void guessUrlFromString();
     void getWebKitVersion();
+
+    void reusePage_data();
+    void reusePage();
 };
 
 // This will be called before the first test function is executed.
@@ -167,6 +172,46 @@ void tst_QWebView::getWebKitVersion()
     QVERIFY(qWebKitVersion().toDouble() > 0);
 }
 
+void tst_QWebView::reusePage_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::newRow("WithoutPlugin") << "<html><body id='b'>text</body></html>";
+    QTest::newRow("WindowedPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf'></embed></body></html>");
+    QTest::newRow("WindowlessPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf' wmode=\"transparent\"></embed></body></html>");
+}
+
+void tst_QWebView::reusePage()
+{
+    QDir::setCurrent(SRCDIR);
+
+    QFETCH(QString, html);
+    QWebView* view1 = new QWebView;
+    QPointer<QWebPage> page = new QWebPage;
+    view1->setPage(page);
+    page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* mainFrame = page->mainFrame();
+    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    if (html.contains("</embed>")) {
+        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
+        QTest::qWait(2000);
+    }
+
+    view1->show();
+    QTest::qWait(2000);
+    delete view1;
+    QVERIFY(page != 0); // deleting view must not have deleted the page, since it's not a child of view
+
+    QWebView *view2 = new QWebView;
+    view2->setPage(page);
+    view2->show(); // in Windowless mode, you should still be able to see the plugin here
+    QTest::qWait(2000);
+    delete view2;
+
+    delete page; // must not crash
+
+    QDir::setCurrent(QApplication::applicationDirPath());
+}
+
 QTEST_MAIN(tst_QWebView)
 #include "tst_qwebview.moc"
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/resources/test.swf b/src/3rdparty/webkit/WebKit/qt/tests/resources/test.swf
new file mode 100644
index 0000000..8952982
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/resources/test.swf